Retrieval-augmented generation can improve relevance by grounding model output in organizational information. It also introduces a chain of security dependencies across ingestion, indexing, retrieval, prompts, model providers, tools, applications, and users.
Preserve source authorization
The retrieval layer should not expose information that the user could not access in the source system. Permission synchronization, identity mapping, group changes, document inheritance, and stale indexes require deliberate control.
Control ingestion and data quality
Source approval, classification, duplication, malicious content, outdated documents, and sensitive metadata can affect both security and answer quality. Ingestion should be governed as a controlled data pipeline.
Treat retrieval as an attack surface
Queries and retrieved content can influence model behaviour. Controls should address prompt injection in source documents, retrieval manipulation, excessive context, untrusted links, and content that attempts to trigger tool actions.
Limit tools and downstream actions
A knowledge assistant becomes materially higher risk when it can send messages, update systems, create transactions, or execute code. Tool permissions, action boundaries, confirmation, logging, and rollback should match the potential impact.
Log the complete decision path
Useful records include user identity, query, retrieved sources, model and configuration, tool calls, output, user feedback, and policy decisions. Logging should be proportionate and protect sensitive content.
What to carry into the next decision.
- Enforce source-system permissions through the retrieval layer.
- Govern ingestion, indexing, and source lifecycle—not only prompts.
- Apply stronger controls when the assistant can take actions.
- Retain enough traceability to investigate output and access decisions.
