padosoft-rag-ingestion-securitylisted

Use this skill when content is brought into a corpus that a model will read — a connector to a document store, a mailbox, a ticket system, a wiki, an upload, a crawl — and whenever the question is who may see what came in. Also when the user reports that an assistant surfaced a document somebody should not have seen, asks how to mirror the source's permissions, worries about content written by outsiders reaching a tool call, or needs personal data kept out of an index. It covers the ingestion contract, permission mirroring that fails closed, authorship provenance, the indirect-injection chain, and redaction before embedding. Do not use it for choosing an embedding model, for retrieval quality, or for the shape of the corpus itself (padosoft-rag-knowledge-base).
padosoft/skills · ★ 1 · AI & Automation · score 80

Install: claude install-skill padosoft/skills

# RAG ingestion security Ingestion looks like a data problem and is an authorisation problem. **The contract records what a document *is* — path, title, type, tenant — and not where its authority comes from.** There is nowhere to put the fact that it was shared with three people, so it arrives readable by everyone with access to the corpus. That is oversharing, and it is the headline failure of enterprise assistant rollouts. The second failure shares its cause: nothing records **who wrote** the content either. --- ## 1. Mirror the source's permissions, or say that you did not A connector reports **what the source said**; it never decides who may read. The distinction is the design. ```text principals (type + external id + allow/deny) inherits_from_parent: bool folder or space inheritance complete: bool false = the source truncated the list ``` The host maps external principals to internal subjects — by verified address, directory link, group mapping. That resolution depends on directory state the connector does not have, which is why it is not the connector's job. **And it will sometimes fail**: an external collaborator, a group the directory does not know, a truncated list. ## 2. Unmapped access fails closed. This is the load-bearing rule **A document whose access could not be fully mapped must not fall back to corpus-wide visibility.** That fallback is exactly the bug this whole design exists to remove, and it is the tempting shortcut every t