Guided security lab

RAG Prompt Injection

A guided RAG trust-path exercise: follow content from source through ingestion, chunking, authorized retrieval and context assembly, then apply identity, provenance, scope and action policy to a model proposal.

Conceptual simulationIntermediate15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional names. It runs no retrieval, embeddings, vector database, model or tools, and it does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Explain why content a principal is authorized to read is not authorized to instruct the assistant or change the task.
Place permission-aware retrieval before context assembly, so relevance and ranking never override identity, tenant or ACL.
Keep source, version, chunk lineage and authorization metadata attached through parsing, chunking and reindexing, and fail closed when it is missing.
Recognize a bounded, legitimate RAG answer path without granting retrieved text authority over future steps.
Separate RAG influence from downstream capability: every consequential action is revalidated outside the model.

Prerequisites

Trust Boundaries and Model Context lab (recommended)
RAG Prompt Injection attack article (optional)

Choose a scenario

Each fictional scenario shows retrieved content the model sees and, separately, the identity, provenance and policy facts the application records. Security decisions belong to the second column.

Retrieved chunk influences, but cannot redefine the taskAn authorized handbook chunk is retrieved to answer a leave-policy question. It contains ordinary policy text and an instruction-like passage.Relevant chunk from a resource the principal may not accessA semantically close chunk exists in the shared index, but it belongs to a restricted resource of another department.Derived chunk with missing or conflicting security metadataA document was parsed, chunked and reindexed. One derived chunk lost its source ACL. The pipeline must fail it closed before context assembly, regardless of what its own text claims.Legitimate bounded RAG answerA contributor-written runbook chunk is retrieved for a principal who may read it. Provenance and ACL are intact, and the task is a read-only question.Retrieved content proposes a downstream actionAn authorized ticket-history chunk reaches the model, and the model proposes sending records to an external destination mentioned in it.

RAG path and trust flow

Content moves from source through ingestion, chunking, authorized retrieval and context assembly before the model sees it. Components are system; documents, chunks and the model proposal stay variable.

User questionVariable content->
Retriever with ACL filterSystem component->
Authorized chunkVariable content->
Context assemblySystem component->
ModelSystem component->
ProposalVariable content->
Task policySystem component

Model-visible retrieved content

Retrieved text the model reads. Bracketed text is a neutral placeholder, not a real instruction.

Retrieved chunk, handbook section 4
Employees accrue leave monthly; carry-over is limited to ten days. [synthetic instruction-like text attempting to redirect the assistant]

Application-side identity, provenance and policy

Recorded by the ingestion pipeline, the retriever and the application outside model text.

Principal: employee-17, tenant acme.example.test
Chunk access: Readable by all employees of this tenant
Task scope: Answer the user's leave-policy question, read-only