Safe RAG implementation guide
Last reviewed: August 30, 2026 · Editor: Prompt Injection Check
Retrieval-augmented generation (RAG) gives a model relevant documents at answer time. Retrieval improves usefulness, but retrieved text is still untrusted input and can contain instructions aimed at the model.
Use a clear trust boundary
Keep system policy, the user’s request, and retrieved passages in separate fields. Label passages as reference material and tell the model to quote or summarize them, never execute instructions found inside them.
Filter and cite
Apply access-control filters before retrieval, limit results to the user’s authorization, and show citations so a person can inspect the source. Do not let a retrieved document choose its own tools, recipient, or permissions.
Validate actions outside the model
Use application code to validate tool arguments, destination allowlists, and record ownership. Require a confirmation step for writes, external messages, money movement, or data export.
Test the pipeline
- Index a synthetic document containing an obvious injection.
- Ask for a normal summary and verify the text is treated as data.
- Attempt a tool action and confirm the application blocks or asks for approval.
- Review logs for sensitive content and unexpected destinations.