The component that reads has no privilege.
Retrieval and summarisation of untrusted content runs with no tool access and no credentials, producing a structured result.
Whatever is indexed
reaches the model.
A retrieval pipeline is a delivery mechanism for content into a model's context. Its security is a question about what can get into the index.
READ THE DEFINITION ↓POISONING · PROVENANCE · EXPOSURE
01 / DEFINITION
The short answer first.What is RAG security?
RAG security is the protection of a retrieval-augmented generation pipeline: controlling what enters the index, tracking where each passage came from, preventing retrieved content from acting as instructions, and protecting the derivatives the pipeline creates.
The defining property is that retrieval is an input channel into the model's context. Anything indexed will eventually be placed in front of a model that cannot distinguish instructions from data, which makes index contents a security question rather than only a data-quality one.
02 / THE THREATS
What is specific to retrieval.| Threat | How it works | Control |
|---|---|---|
| Index poisoning | A document is added that will be retrieved for many queries and steer the answer | Control who can write to indexed sources; provenance on every chunk |
| Injection via retrieved content | Instructions inside a document that the model follows | Untrusted-by-default handling; separate reading from acting |
| Embedding exposure | Vectors stored with weaker access control than their sources | Same access policy as the source document |
| Query leakage | The query itself is sensitive and is sent to an external service | Local embedding and rewriting; no external calls in the query path |
| Stale permissions | The index reflects access rights that have since changed | Query-time authorisation against the authoritative source |
Index poisoning deserves more attention than it receives, because the write path into an index is often much wider than the read path is controlled. Any system or person who can add a document to an indexed location — a shared drive, a wiki, an inbox, a ticket system — can influence what a model says to everyone who asks a related question. The relevant question for any deployment is: who can put a document where this pipeline will index it?
03 / PROVENANCE
The control that makes the others possible.Every chunk
knows where
it came from.
Provenance metadata on every indexed unit — source system, document identifier, author, ingestion date, trust level and access metadata — is the foundation for nearly every other retrieval control. It enables citation in answers, per-source trust weighting, targeted removal when a source is compromised, permission filtering at query time, and after-the-fact investigation of why a model said something.
The trust-level field is the one most often missing. A pipeline that indexes internal policy documents alongside client-supplied attachments and scraped external pages is combining sources with entirely different trustworthiness into one undifferentiated pool. Recording the level allows downstream handling to differ: external content might be excluded from any context that reaches a tool-using agent, or presented to the model with its provenance explicit.
Provenance is also what makes the incident tractable. When an unwanted output is traced to a poisoned or misleading passage, the questions are which document, who added it, when, and what else it has influenced — and none of them can be answered without it. See AI agent monitoring.
04 / SEPARATING READING FROM ACTING
The architectural control.The privileged component reads a schema.
Anything that can act consumes validated structured output, not free text, which breaks the direct path from injected content to action.
Citations are verified, not trusted.
Check that every cited identifier resolves in the index. Fabricated references are the cheapest fabrication to detect.
This separation is the most effective structural defence available for retrieval pipelines that ingest third-party material, and it is less commonly implemented than it should be because it requires designing an interface rather than handing one model every capability. The broader argument is in AI agent prompt injection and AI agent privilege escalation.
05 / QUESTIONS
Asked when reviewing a retrieval pipeline.Can a document in the index attack the model?
+
It can steer it. Instructions placed in an indexed document are retrieved and enter the context, where the model has no reliable way to distinguish them from developer instructions. Where the model has tools, that is an action path; where it does not, it is still an output-integrity problem.
Do embeddings need the same protection as documents?
+
Yes. An embedding is a lossy but informative derivative of the source text and research has repeatedly shown meaningful recovery is possible. Store vectors under the same access policy as the documents they came from.
How do you stop index poisoning?
+
Control the write path into indexed sources, record provenance on every chunk, and assign trust levels by source rather than treating all indexed content as equivalent. Monitoring for documents that are retrieved unusually often across unrelated queries is a useful additional signal.
Is it safe to index external web content?
+
Only with provenance, a low trust level, and no path from that content to a privileged action. Indexing arbitrary external pages into the same pool as internal documents is the configuration most likely to produce an incident.
Does the query itself need protecting?
+
Often, yes. Queries frequently contain client names, matter references and the substance of a confidential question. Any external embedding or rewriting service in the query path transmits that outside the boundary. See private AI inference.
Control what
gets indexed.
Privilege AI builds retrieval systems where provenance, permissions and trust level are part of the pipeline.