.svg)
TL;DR
- RAG expands your AI system’s data surface and creates new leakage paths through retrieval and prompts.
- Use AISPM controls to govern ingestion sources, vector store access, retrieval policy, and output handling.
- OWASP LLM Top 10 is a strong taxonomy for RAG failures, especially prompt injection and sensitive data disclosure.
Why RAG needs posture management
RAG systems do two things that change risk:
- They ingest and transform enterprise data into retrievable context
- They retrieve data at runtime and place it into prompts and tool context
That creates posture questions:
- What is ingested, from where, and who approved it
- Who can retrieve what, and under which identity
- What gets logged, retained, or forwarded in outputs
RAG posture controls by layer
Ingestion posture
- Approve sources and define what is allowed into the corpus.
- Track provenance: source, timestamp, owner, and classification.
- Sanitize content types that can carry hidden instructions or active content.
Embeddings and vector store posture
- Enforce access control at the vector store.
- Use tenant and namespace segmentation by team, environment, and sensitivity.
- Log retrieval queries and document IDs returned.
Retrieval posture
- Define retrieval policies by role and data class.
- Set limits: top-k bounds, maximum context size, and rate limits.
- Add “policy filters” so restricted classes are not retrievable.
Prompt and output posture
- Prevent sensitive data disclosure in outputs through redaction and policy checks.
- Control output logging and retention.
- Treat outputs as potentially sensitive, especially for regulated data.
OWASP highlights sensitive information disclosure as a key LLM risk, which becomes especially relevant when RAG places internal data directly into prompts.
Monitoring and anomaly detection
- Detect retrieval spikes, unusual query patterns, and sudden expansion of accessible documents.
- Detect cross-domain retrieval: content pulled from unrelated domains for a request.
- Alert on repeated retries and looping behaviors.
Testing
- Validate RAG against prompt injection patterns and “instruction contamination.”
- Run seeded tests with restricted documents to confirm they are not retrievable.
