rag

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Assume the parser will be exploited, then decide what the exploit gets. The scored design has a disposable worker with nothing worth stealing, no way out, and a narrow, validated return path.

You cannot protect data you have not found, and you cannot find it once it has been copied into ten places. The toolchain answer follows data from discovery to the AI index.

Three ways to give a model your data, three different places the data ends up. The answer that scores follows the data and asks how you would delete it.

An easy question with a lot of surface area. The scored answer walks the pipeline left to right, names the attacker's lever at each stage, and ties each to one control.

Trace editable source material through retrieval, actual context, model behavior and observed effects. Work through a synthetic result with denied proposals and an unresolved receipt.

Map protected context to its actual readers. Distinguish unauthorized retrieval from redistribution, inspect drafts and rendering, and verify disclosure without assuming every prompt inevitably leaks.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.