rag-securitylisted

# RAG Security Retrieval-augmented generation moves the security question from "what can the user type" to "what can the index serve". The moment you embed documents and let similarity search decide what enters the context window, you have created a new authorization surface, a new injection surface, and a new leakage surface — and none of them are covered by your API-layer auth, because retrieval happens *after* the request was authorized. The single most common RAG failure is embarrassingly simple: **everything gets embedded into one index, and nothing filters at query time**. Semantic search does not know about your permission model. If a restricted document is in the searchable set, a well-phrased question will surface it. This skill covers that failure and the rest of the RAG-specific trust boundaries. It pairs with [`prompt-injection-defense`](../prompt-injection-defense/SKILL.md) (what retrieved text can trigger) and [`llm-app-security`](../llm-app-security/SKILL.md) (operational controls around the model call). ## When to invoke - Building or reviewing a RAG feature over documents that are not uniformly public - Adding a second tenant, team, or permission tier to an existing single-index deployment - Designing an ingestion pipeline that accepts user-contributed or externally-fetched documents - Investigating a report that the assistant answered with content the user should not see - Pre-launch evaluation of any retrieval-backed assistant - Handling a GDPR deletion