AI Security
RAG Security: Preventing Data Leaks, Unauthorized Retrieval, and Poisoning
A practical guide to protecting retrieval pipelines, vector stores, source documents, and tenant boundaries.
Retrieval-augmented generation can make internal knowledge useful, but it can also expose the wrong document to the wrong person. Learn how to secure sources, permissions, embeddings, retrieval filters, and AI output.
Table of Contents
- Why RAG is not an access-control system
- The RAG security pipeline
- A safe retrieval example
- How to test RAG securely
- Risk rating
- Controls that keep retrieval governed
Why RAG Is Not an Access-Control System
Retrieval-augmented generation gives a model relevant context from an external knowledge base. It can improve usefulness, but semantic similarity does not determine whether a person is allowed to see a document.
A secure RAG application applies identity, tenant, classification, purpose, and document permissions before content reaches the model. The model should receive only information the verified caller is already allowed to access.
The RAG Security Pipeline
Risk begins before a question is asked. Source documents can contain stale data, hidden text, malicious instructions, confidential material, or content from an unverified publisher. Permissions can also change after documents are embedded.
Security spans ingestion, extraction, classification, embedding, storage, retrieval, model prompting, output handling, and monitoring. A weakness at any point can lead to disclosure, manipulation, or unsafe decisions.
Approved source -> validate + classify -> ingest -> vector store
Verified user + request -> policy-aware retrieval -> model -> cited answer
|
tenant + document permissionsA Safe Retrieval Example
Imagine an internal policy assistant used by teams in several regions. A user asks about leave rules, but the knowledge base contains restricted legal guidance for another region and confidential employee records.
The safe design evaluates the caller's verified identity and region before retrieval. It searches only permitted collections, applies document-level filters, records selected chunks, and gives the user an answer with traceable sources.
How to Test RAG Securely
- Use synthetic documents with distinct tenants, roles, classifications, retention states, and expected visibility.
- Verify that retrieval filters are enforced before the model receives content, not merely described in a system prompt.
- Test ingestion for malformed files, hidden content, prompt-like instructions, duplicate records, and unapproved sources.
- Confirm that permission changes, deletion, and retention events are reflected in the retrieval path.
- Review answers for citations, data minimization, cross-context leakage, and unsafe reliance on untrusted instructions.
- Log the source, retrieval filter, policy decision, selected chunks, and outcome without storing unnecessary sensitive prompt data.
Risk Rating
| Severity | Description |
|---|---|
| Critical | Cross-tenant or highly restricted data is retrieved and exposed through an AI experience. |
| High | Poisoned or untrusted knowledge changes decisions, causes sensitive disclosure, or influences a connected agent. |
| Medium | Stale, misclassified, or poorly filtered content produces incorrect advice or limited data exposure. |
| Low | A non-sensitive answer lacks freshness or citation quality without changing an important decision. |
Controls That Keep Retrieval Governed
- Maintain source provenance, ownership, classification, and review status for every ingested source.
- Use permission-aware storage and retrieval with strong tenant isolation and document-level enforcement.
- Validate and quarantine suspicious or unverified material before embedding.
- Minimize the content and metadata sent to the model, and avoid embedding secrets that are unnecessary for the use case.
- Support revocation, deletion, re-indexing, and freshness checks as part of the knowledge lifecycle.
- Require human review or a deterministic policy check when an answer could trigger a material decision or external action.
RAG and Vector Database Security Checklist
- Every knowledge source has an owner, classification, provenance, and retention rule.
- Tenant, role, and document permissions are enforced before retrieval.
- Ingestion validates document content and quarantines untrusted or suspicious sources.
- Retrieval logs provide evidence of what was selected and why.
- Permission changes and document deletion are reflected in the retrieval lifecycle.
- Sensitive or consequential outputs have citations, guardrails, and appropriate human review.