A Retrieval-Augmented Generation (RAG) system answers questions using documents it retrieves from a vector database, not just what the model was trained on. That retrieval step is also a new attack surface: anyone who can influence what gets indexed can potentially influence what the model says, who can see it, and what it does next.

RAG Security is a focused technical review of the retrieval layer — separate from, and deeper than, the general AI-product review covered under AI Security Kenya.

Who this is for

Teams operating a RAG chatbot, AI search, or internal knowledge-retrieval system on customer or internal documents.
Products where different users or roles should see different subsets of the underlying knowledge base.
Systems that ingest documents from external or semi-trusted sources (uploads, emails, scraped content, support tickets).

What gets reviewed

Review Area	What Is Examined
Vector DB Access Control	Who can read, write, or re-index the vector store; whether tenant/customer data is isolated.
Indirect Prompt Injection	Whether instructions embedded in retrieved documents can override system behaviour or exfiltrate data.
Source Freshness & Provenance	Whether stale, superseded, or unverified documents can surface as if authoritative.
RBAC Metadata Filtering	Whether retrieval correctly excludes documents a given user or role is not permitted to see.
Ingestion Pipeline	Whether the ingestion path itself can be abused to insert malicious or misleading content.

The boundary: permission before testing

RULES OF ENGAGEMENT

No assessment begins without a signed scope defining exactly which retrieval pipelines, indexes, and environments are in scope, the testing window, and the escalation contact. Testing is non-destructive by default and stays inside the agreed scope as a matter of policy, not negotiation.

Complementary engineering work

RAG security review pairs naturally with the RAG pipeline engineering work documented by HarLyn Digital Partners' AI Systems Lead, Harrison Ndeke, including his public field note on RAG source freshness, provenance, and access control and his RAG Developer Kenya service. Security review is most effective when scoped alongside, not after, pipeline design.

What you receive

Findings register: retrieval-layer issues with severity and reproduction evidence.
Access-control map: what data each role/tenant can actually retrieve, verified rather than assumed.
Remediation guidance: specific fixes for metadata filtering, ingestion validation, and provenance tracking.

How engagements start: the 48-Hour Secure Digital Workflow Assessment

Most clients begin with the 48-Hour Secure Digital Workflow Assessment, delivered jointly with HarLyn Digital Partners, which identifies whether a dedicated RAG security review is warranted.

START HERE

Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.

Request a Scoping Call →