Practical guidance on securing AI agents, tools, and the systems they act on, written by the team building the trust layer for AI agents.
Embeddings are not guaranteed to be anonymous, and treating them that way can lead to under-protecting a data store that still carries meaningful privacy risk.
Chunk size and boundaries determine how much context and access metadata travels with retrieved content, and getting them wrong creates both leakage and injection risk.
Detecting malicious documents before ingestion combines pattern-based scanning, structural checks, and provenance review, since no single check catches every technique.
The ingestion pipeline is where access metadata, classification, and content review happen once, and mistakes made there propagate to every future retrieval.
Protecting confidential documents in RAG means deciding what should be indexed at all, then enforcing access, redaction, and retention deliberately for the rest.
Metadata filtering in retrieval is often built for relevance, but when it carries access rights it becomes a security control that has to be treated as one.
Multi-tenant RAG isolation needs a mandatory tenant scope enforced structurally at the query layer, not an optional filter application code can forget to apply.
A vector database needs the same authentication, network isolation, and access control as any sensitive data store, plus tenant scoping built into its schema.
Data leakage from RAG comes from unfiltered retrieval, over-broad context inclusion, and responses that imply sensitive details, not just direct data breaches.
Document poisoning plants manipulative content in a source that feeds retrieval, waiting for a relevant query to deliver the payload into a model's context.
Access control for RAG has to filter candidate documents by the requesting user's permissions before ranking by relevance, not after, or authorization does not hold.
RAG adds a data path into the model that bypasses conventional query-time access control, turning every writable content source into a potential injection vector.
