- 01Default RAG = single index, no entitlement enforcement at retrieval time = a data-leakage architecture by construction. This is the source of the majority of AI-related data-leakage incidents we respond to.
- 02Three failure modes to defend against in parallel: cross-entitlement retrieval, indirect prompt injection via retrieved content, and embedding inversion against the vector store itself.
- 03Per-identity retrieval filters are mandatory — metadata filter as the minimum, separate index per major entitlement class as the rigorous form. Never rely on the model to 'know not to use' a chunk it received.
- 04Treat your vector database as PII. Reconstructable embeddings mean the access control on the vector store must match the access control on the source documents.
RAG is the most common production AI pattern. It is also the source of most AI data-leakage incidents we have responded to. The default architecture — single index, retrieved without entitlement checks — is fundamentally a data-leakage architecture.
The three failure modes
- 01Cross-entitlement retrieval — user A retrieves data only user B should see
- 02Indirect prompt injection — retrieved documents carry attacker instructions
- 03Embedding inversion — vector representations leak information about source text
Architecture that respects entitlements
Per-user (or per-entitlement-class) filters on retrieval. The vector database returns only chunks the requesting identity is entitled to read. The simplest form is a metadata filter; the rigorous form is a separate index per major entitlement class. Whatever you choose, do not rely on the model to 'know not to use' retrieved content — it will use it.
Indirect injection mitigation
Treat retrieved content as untrusted. Use the isolation pattern from prompt-injection defense: a view-only model summarizes retrieved content, the planner model never sees raw retrieved text. Strip or escape any retrieved content that contains apparent instructions.
Embedding leakage
Embeddings are reconstructable to a meaningful degree. Treat your vector database as a sensitive data store. Encryption at rest, access controls equivalent to the source data, and log auditing apply.