RAG security best practices

Map the retrieval path

Before adding a detector, document every place content can enter the knowledge base: administrative uploads, customer attachments, crawled pages, ticket histories, shared drives, vendor feeds, and tool responses. Record who can write each source and which tenants can retrieve it.

Provenance should survive chunking and ranking. A retrieved chunk without a source identifier, owner, tenant, revision, and ingestion path is difficult to investigate after an incident.

Reduce what the model receives

Retrieve the smallest useful context. Enforce tenant filters before similarity search, cap document and token counts, and reject sources that fail access checks even when they rank highly. Relevance is not authorization.

• Apply identity and tenant filters before retrieval, not after generation.
• Keep document identifiers and source metadata beside every chunk.
• Limit top-k and total context size to the task's actual need.
• Quarantine newly ingested or changed sources until their policy permits use.

Inspect after retrieval, before assembly

Scanning an entire knowledge base at ingestion is useful, but it is not enough. Documents change, chunks combine, and the risk of a passage depends partly on the query and neighbouring material. Inspect the exact selected context immediately before it becomes part of the prompt.

Send document IDs, text, metadata, optional retrieval scores, and the user query to /v1/rag/scan. Keep the returned scan ID with the application request so an operator can connect model behaviour to the security decision that preceded it.

Separate generation from authority

A safe-looking answer does not make a proposed action authorized. Any refund, data export, account change, outbound message, or external request must pass deterministic business rules using the authenticated actor and current application state.

Use /v1/tools/scan as an additional inspection boundary, then apply ordinary authorization, amount limits, destination allowlists, idempotency, and human approval where consequence demands it.

Operate the control

Start in detect mode with representative support cases, including security discussions that look superficially suspicious. Review evidence, label false positives and misses, and define what happens when context is rejected. Only then enable enforcement for a boundary the team can support.

No detector is complete. Maintain incident response, source revocation, evidence retention, and a way to replay the exact retrieved context that produced a decision.