Retrieved content is a trust boundary
A threat-model note on provenance, cross-document composition, and the point where relevant data becomes model context.
Relevance is not trust
A retriever answers which chunks are similar to a query. It does not establish who wrote them, whether the current user may access them, or whether their text should be interpreted as instruction. Those are separate questions and need separate controls.
The important boundary sits after ranking and before prompt assembly. At that point the application knows the exact query, selected chunks, source metadata, and ordering that will reach the model.
Composition changes risk
A single chunk may look harmless while several chunks form a complete instruction when combined. Chunk-level ingestion scanning cannot fully represent that composition. Runtime inspection should therefore evaluate both individual documents and the selected set.
- Preserve stable document and chunk identifiers.
- Carry tenant, owner, revision, and source metadata through retrieval.
- Evaluate query-to-document mismatch and cross-document instruction patterns.
- Store evidence against the exact selected context.
Operational conclusion
Treat retrieved text as untrusted even when it comes from an internal index. Apply access control before retrieval, inspect selected content before assembly, and keep a fallback that can exclude or quarantine a suspicious source without failing the entire support workflow.