references/security-boundaries.md

# Security boundaries for RAG
RAG inherits source permissions and adds ingestion, embedding, index, cache, retrieval, reranking, model and tool boundaries.

- Enforce ACL/tenant/resource authorization in a trusted retrieval layer before returning context, including metadata filters and source IDs. Verify cache partition keys.
- Treat retrieved text, web pages, file contents and metadata as untrusted data; never execute their instructions, shell commands or network destinations.
- Defend against malicious documents that request secret disclosure, prompt changes, tool invocation, or access to other tenants. Test both false positives and bypass attempts.
- Verify ingestion provenance, poisoning controls, editable source restrictions, deletion propagation, and version updates.
- Redact credentials, sensitive personal data and retrieved content in logs and traces. Separate telemetry access from corpus access.
- Constrain external URLs and tool calls; require explicit confirmation for consequential actions and production modifications.
- Don't assume output filtering repairs source authorization violations; if unauthorized context reached the model, treat as a security incident.

## Security acceptance tests
Cross-tenant filters, poisoned top-k result, malicious metadata, source permission revoked after cache fill, unsafe external URL, secret-bearing document, deleted-source citation and model-requested tool misuse.
OWASP: https://genai.owasp.org/llm-top-10/ ; https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html