RAG Security describes the service and positioning; this guide is the hands-on implementation reference for a team building a retrieval-augmented system today.
1. Apply access control at the retrieval layer, not just the app layer
If different users should see different documents, enforce that with row-level security or metadata filtering inside the vector database query itself — not by trusting the application layer to filter results after retrieval, which is trivially bypassable.
2. Treat retrieved content as untrusted input
Indirect prompt injection happens when a retrieved document contains instructions the model follows as if they came from the user. Retrieved content should be clearly delimited from system instructions and never treated as inherently trustworthy just because it came from your own knowledge base.
3. Track source freshness and provenance
Stale or superseded documents in the index can cause the model to confidently state outdated information. Tag documents with ingestion date and source, and have a real process for retiring outdated content, not just adding new content on top.
4. Validate embeddings pipeline integrity
If your ingestion pipeline accepts user-uploaded documents, that's an injection surface too — a malicious document can be crafted to manipulate future retrievals for other users.
5. Log what was retrieved for every response
When a RAG system gives a wrong or harmful answer, you need to know what was actually retrieved and fed to the model — not just the final generated text.