AI SECURITY WORKBENCH · RETRIEVAL TESTING

Retrieval Authorization, Context, and Indirect Injection Testing

Test whether retrieval is authorized, trustworthy, and safe to place in model context.

RAG Security Testing evaluates identity and tenant boundaries, retrieval authorization, source provenance, context integrity, poisoned content, indirect prompt injection, stale permissions, sensitive-data exposure, and the path from query through retrieval, policy enforcement, model context, and response.

Test RAG Boundaries Scope RAG Review

WAS RETRIEVAL AUTHORIZED?

Boundary Testing

Cross-tenant, cross-role, stale-permission, and revoked-user retrieval cases.

Source Provenance

Validate citations, source lineage, and source-laundering paths.

Privacy Gates

Check whether sensitive or regulated chunks enter retrieved context.

Poison Testing

Test poisoned documents and indirect prompt injection before context reaches the model.

AI Security Workbench · Retrieval Authorization, Context, and Indirect Injection Testing

RAG Security Testing

Tenant-boundary tested

Authorization boundaries

Test cross-user, cross-tenant, cross-role, revoked-user, stale-permission, contractor, administrator, and external-guest cases.

Source provenance

Test whether origin, trust, ownership, freshness, citation, and transformation remain available through retrieval and generation.

Sensitive-context controls

Determine whether regulated, private, tenant-restricted, secret, or otherwise sensitive content enters context without the required policy decision.

Poisoning and indirect injection

Test hostile or misleading corpus content, source laundering, metadata manipulation, and instructions embedded in retrieved content.

Failure classes tracked

Cross-tenant retrieval, cross-role retrieval, stale permission, revoked access, sensitive-context exposure, poisoned content, source laundering, provenance loss, indirect prompt injection, and unsafe action propagation.

Cross-tenantCross-roleStale permissionPoisoned contentSource laundering

AI Security Workbench · Retrieval Authorization, Context, and Indirect Injection Testing

RAG Security Testing

Tenant-boundary tested

Authorization boundaries

Test cross-user, cross-tenant, cross-role, revoked-user, stale-permission, contractor, administrator, and external-guest cases.

Source provenance

Test whether origin, trust, ownership, freshness, citation, and transformation remain available through retrieval and generation.

Sensitive-context controls

Determine whether regulated, private, tenant-restricted, secret, or otherwise sensitive content enters context without the required policy decision.

Poisoning and indirect injection

Test hostile or misleading corpus content, source laundering, metadata manipulation, and instructions embedded in retrieved content.

Failure classes tracked

Cross-tenantCross-roleStale permissionPoisoned contentSource laundering

Core capabilities

What RAG Security Testing does.

Identity cases

Test cross-user, cross-tenant, revoked user, contractor, admin, and external guest access cases. Validate that retrieval respects identity and authorization — not just query relevance scores.

Tenant-boundary tests

Seed fixture documents scoped by tenant, role, and permission state. Confirm retrieval gates enforce boundaries and do not bleed across tenants on revoked or stale permissions.

Poisoned-corpus checks

Seed poisoned fixture documents and indirect prompt-injection content. Confirm hostile content is blocked before it enters the context window and influences model responses.

Context-leak checks

Capture query → retrieval → policy check → context window → response. Classify leakage events by type: cross-tenant, cross-role, stale permission, poisoned content, source laundering.

Full Pipeline Evidence Capture

Produce structured evidence showing what entered context, what was blocked, and what leaked. Export as boundary test plan, identity test cases, and evidence pack.

RAG-Specific Regression Harness

Turn test results into replayable regression fixtures. Build a permanent authorization test suite that runs on every corpus or model update.

Evidence & signals

What you get out of the box.

What it produces

Boundary test plan
Identity and tenant test cases
Poisoned corpus scenarios
Source provenance findings
Context leakage findings
Evidence pack export
Regression harness bundle

Leakage categories

Cross-tenant
Cross-role
Stale permission
Poisoned content
Source laundering
Indirect prompt injection

Export formats

Evidence Pack (ZIP)
Results Report (PDF)
Control Mapping (CSV)
Query / Chunk Log (JSON)

Red team + Blue team

Built for both sides of the security equation.

Red Team Use

Demonstrate cross-tenant retrieval using fixture documents scoped to restricted tenants
Show stale-permission access: fixture files retrieved after authorization was revoked
Inject poisoned fixture documents and confirm whether they influence model responses

Blue Team Use

Export ACL evidence, source provenance reports, and policy-check audit logs
Build RAG regression suites that run automatically on every corpus or model update
Map retrieval findings to governance controls for buyer-ready evidence

Retrieval crosses a sequence of trust and authorization boundaries.

RAG security depends on more than the final answer. Risk can enter through content ingestion, document identity, metadata, authorization, storage, indexing, query handling, retrieval, ranking, context assembly, prompt construction, generation, output handling, and downstream action.

RAG-01imported graph

Retrieval Trust Topology

RAG security depends on the full path from query and corpus boundaries through ranking, prompt assembly, model behavior, and output.

Mapping these boundaries reveals where authorization, provenance, tenant isolation, filtering, citation, and action controls must hold for the final answer to be trustworthy.

Test the system by failure class, not by jailbreak count.

A complete RAG review examines whether identity mistakes, retrieval manipulation, hostile content, provenance loss, tenant-boundary failure, sensitive-context exposure, unsafe generation, and downstream actions are reachable in this architecture.

RAG-02coverage matrix

RAG Failure-Mode Coverage

A useful harness separates prompt injection, corpus poisoning, cross-tenant retrieval, provenance loss, and unsafe action propagation.

Failure modes

Ingest

Retrieve

Assemble

Generate

Act

Retest

Indirect prompt injection

Hostile instructions enter through retrieved content.

Covered

Partial

Covered

Corpus poisoning

Malicious or misleading content affects retrieval and generation.

Covered

Partial

Covered

Partial

Covered

Cross-tenant retrieval

Content crosses an intended tenant or access boundary.

Partial

Covered

Partial

Planned

Provenance loss

The system cannot preserve or communicate source origin and trust.

Covered

Partial

Unknown

Covered

Unsafe action propagation

Retrieved content influences a tool or consequential action.

Not applicable

Partial

Covered

Partial

Indirect prompt injection

Hostile instructions enter through retrieved content.

Ingest: Covered
Retrieve: Covered
Assemble: Covered
Generate: Covered
Act: Partial
Retest: Covered

Corpus poisoning

Malicious or misleading content affects retrieval and generation.

Ingest: Covered
Retrieve: Covered
Assemble: Partial
Generate: Covered
Act: Partial
Retest: Covered

Cross-tenant retrieval

Content crosses an intended tenant or access boundary.

Ingest: Partial
Retrieve: Covered
Assemble: Covered
Generate: Covered
Act: Partial
Retest: Planned

Provenance loss

The system cannot preserve or communicate source origin and trust.

Ingest: Covered
Retrieve: Covered
Assemble: Covered
Generate: Partial
Act: Unknown
Retest: Covered

Unsafe action propagation

Retrieved content influences a tool or consequential action.

Ingest: Not applicable
Retrieve: Partial
Assemble: Covered
Generate: Covered
Act: Covered
Retest: Partial

Coverage states

CoveredPartialPlannedUnknownNot applicable

The matrix must be reviewed against the live harness. A named failure mode is not evidence that every pipeline stage is covered.

The goal is not to maximize prompt variants. It is to determine which failure classes are reachable in this architecture, what controls should prevent them, and what evidence supports the conclusion.

Live fixture route

Walk through a retrieval security test run with a live ACME Corp fixture.

Open the demo to explore tenant boundary tests, leakage events, corpus inventory, and framework coverage — all fixture-driven.

Test RAG Boundaries Scope RAG Review

A reproduced RAG failure should become durable evidence.

Preserve the source document or corpus condition, retrieval trace, assembled context, model behavior, control state, consequence, remediation, and retest result as one connected case.

RAG-03

RAG Retest and Evidence Flow

A retrieval failure is closed only after corpus, ranking, policy, or action controls are changed and replayed.

RAG retest lifecycle

1
Reproduce the failure
Capture query, retrieved content, ranking, prompt assembly, model output, and action state.
2
Identify the control boundary
Determine whether the failure arises in ingest, retrieval, isolation, provenance, prompt assembly, or action policy.
3
Change the control
Update corpus, ranking, metadata, tenant policy, prompt policy, or tool policy.
4
Replay the scenario
Use the original and adversarial variants under the changed system.
5
Review the evidence
Confirm the intended boundary and inspect alternative failure paths.

Retest loop returns to Identify the control boundary

What did the retest prove?

Closed
Residual
Failed
Inconclusive

This turns a one-time demonstration into an engineering artifact that can guide remediation, verify isolation and provenance controls, prevent regression, and support a release or risk decision.

Delivery & licensing

Available through the model that fits the product outcome.

Expert-led engagement

AI Security LLC validates retrieval authorization and context boundaries directly as part of an assessment.

Bounded partner pilot

One representative retrieval configuration is tested and returned as a tenant-boundary and leakage report.

OEM or licensed capability

The harness can run headless behind a partner's own RAG or knowledge-platform product.

Accepts

A representative retrieval configuration, tenant boundary, and corpus fixture.

Returns

Cross-tenant leak findings, poisoned-content detections, and indirect-injection results.

Current maturity

Fixture-tested

Explore Partner Interoperability

AI SECURITY WORKBENCH

Test retrieval boundaries before unsafe context reaches the model or an action.

Start with one representative retrieval pipeline, identity model, corpus, tenant boundary, or unsafe action concern. Produce bounded test cases, observed outcomes, remediation requirements, regression fixtures, and evidence.

Scope an AI Security Review See the full Workbench

Continue through the Workbench

Threat Canvas

Model the retrieval components, identities, flows, data, and trust boundaries.

Explore

Continue through the Workbench

Prompt Security Review

Review retrieval templates, system instructions, corpus documents, and embedded guidance.

Explore

Continue through the Workbench

Adversarial Range

Exercise retrieval failures inside wider application and agent workflows.