RAG over your customers' data
What you are building
You retrieve customer content and put selected chunks into a model's context so it can answer a question. The retrieval query decides which data the model receives before it writes that answer.
Where untrusted text gets in
- Uploaded files and pages that customers or other users can edit.
- Retrieved chunks, including text hidden in a source document's styling.
- Search and tool results added alongside the user's question.
- Previous content that remains in a retrieval store after a visible message is deleted.
What it can do if it goes wrong
- Put another tenant's chunks into the current user's model context.
- Treat instructions in a document as authority over the answer or available tools.
- Disclose prompt secrets or cause a network request through an answer's rendered image or link.
- Recall deleted content from a derived copy that the delete path did not remove.
Know the limit
A tenant filter does not make the retrieved text trustworthy. The model can still follow an instruction from a document that the user is allowed to read. If retrieval happens inside a tool-calling agent, use the tool and approval controls too, and assert on the actions it actually attempts.
Minimum controls
Treat retrieved and uploaded content as data, not instructions
Outside text is labeled as untrusted, hidden document text is checked, and tools that send data or change state are removed or gated.
Isolate tenants in retrieval
Retrieval uses the session's tenant ID in the datastore query, and cross-tenant canaries never appear in retrieved chunks.
Render model output as untrusted
Model output cannot inject active HTML or load images and links from unapproved hosts, and model-written URLs are never fetched automatically.
Assume your system prompt will leak
System prompts contain no keys, internal URLs or credentials, and security rules are enforced in code.
Make delete mean the model can no longer recall it
Deletion reaches every documented copy of user content, or the product explicitly identifies retained copies and their limits.
Run injection tests on every change
A fixed pack of attacks and benign controls checks tool calls and arguments in CI when prompts, models or tools change.