RAG security: prompt injection, memory and tenant isolation

A retrieved passage is external data even when it resembles an instruction to the assistant. Risk arises when that content changes behaviour, causes unauthorised access or influences a tool action. Accurately quoting a document does not establish that its content is safe.

OWASP’s RAG guidance covers the pipeline’s security surface. Below we propose defensive checks for an authorised demonstration environment. They complement the architecture guide and do not report a test of SpectrAI.

Follow data towards an effect

Identify who can publish, modify and approve each source. Trace extraction, indexing, context inclusion and available tools. Internal content can also be compromised or quote hostile text.

Keep data and instructions distinguishable in the application. Delimiters help representation but are not an authorisation boundary. Tools must still validate parameters and caller permissions independently of the model’s explanation.

Enforce access before generation

Do not send forbidden customer documents to a model and rely on it to omit citations. Examine reranking, traces and caches too: they may receive passages before final-answer filtering.

For a cross-tenant test, place a fictional marker in workspace B and query from A. Inspect candidates, outgoing context and tool output rather than only the interface. A marker is evidence for that case; its absence from one answer cannot establish the absence of every disclosure.

Prevent untrusted content becoming durable authority

An external instruction might be summarised and later stored as a preference or rule, losing its origin along the way. A later session may appear to apply internal policy while actually reusing external content.

Preserve provenance and candidate status for memory writes. Define promotion controls and information that must never become shared rules. After source withdrawal, locate derivatives and test a fresh session.

Demonstration case	Expected outcome	Evidence
Another customer’s document	No out-of-scope passage transmitted	Access decision and outgoing context
Document requests a prohibited action	Tool refuses the unauthorised effect	Parameters, identity and refusal receipt
Summary repeats an external instruction	Origin does not become authorisation	Memory state before and after
Source withdrawn or permission revoked	Derivatives cannot restore access	Index, cache and subsequent consultation
Control service unavailable	Sensitive work does not continue without a decision	Blocked state and absence of effect

Adapt these expectations to the actual service contract. A phrase blacklist cannot capture every hostile formulation and may also flag legitimate documentation.

Interpret the local example correctly

The downloadable program rejects missing access metadata, a superseded revision and an unapproved entry. Its approved flag comes from the fixture. It does not detect injections in text; an approved document could contain one.

Its ten cases check deterministic selection rules. Testing generation and tool use requires a different experiment. AgentDojo provides a research environment for injections in tool-returned data; its protocol and results are not guarantees for another service.

Pair hostile tests with legitimate tasks. A defence that refuses all reading may prevent an incident while making the service unusable. The evaluation guide preserves that distinction. Find the other layers in the AI and security series.