RAG documents before model context

Return only active documents authorized for the trusted actor, preserving valid access and leaving the original records unchanged.

AI Security · about 60 minutes. Fictional evidence; Python 3.10+ for local coding.

Prerequisites

• RAG tenant isolation
• RAG security risks

Evidence

retrieval-actor.json

{
  "authenticated": true,
  "tenant": "acme",
  "allowed_ids": [
    "a-1",
    "a-old"
  ]
}

candidates.json

[
  {
    "id": "a-1",
    "tenant": "acme",
    "active": true,
    "text": "Allowed invoice guide"
  },
  {
    "id": "b-1",
    "tenant": "birch",
    "active": true,
    "text": "Private Birch invoice"
  },
  {
    "id": "a-old",
    "tenant": "acme",
    "active": false,
    "text": "Revoked draft"
  },
  {
    "id": "a-2",
    "tenant": "acme",
    "active": true,
    "text": "Another Acme restricted document"
  }
]

retrieval-contract.txt

Eligibility is decided before documents are sent to the model.
Only authenticated actors may retrieve active documents in their trusted tenant and allowed_ids.
Ignore request-supplied tenant and allowed_ids claims. Missing authorization metadata does not mean public.
Preserve record order and do not mutate the input records. This fixture does not perform vector ranking.

Tasks and expected evidence

1. List which candidates may reach the model and cite the actor and document metadata that decide each outcome.
2. Repair rag_documents in the Python download. Do not use request_claims to broaden access.
3. Run --lab rag against your edited function. Include legitimate access, cross-tenant denial, revoked access, missing metadata and spoofed claims.
4. Write a report proposing one integration test for cache isolation or permission revocation at the actual context-building boundary.

Run the coding exercise

Download the Python exercise. It uses only the standard library and no network.

python expert_security_lab.py --lab rag
python expert_security_lab.py --lab rag --reference

Starter mode initially fails. Edit the matching function and rerun without --reference. Reference mode tests supplied code, not your own fix.

Limits

The exercise models eligibility over dictionaries, not embeddings, approximate-nearest-neighbor filtering, caches or real identity services. Passing it does not prove the complete retrieval system is isolated.

All expert cases