RAG knowledge store security pipeline

Control objective

This control secures the pipeline that loads documents into a RAG (retrieval-augmented generation) knowledge store, ensuring that secrets and personal data are caught before ingestion and never resurface in model answers — addressing the data-from-information-repositories threat (MITRE AML.T0082, OWASP ASI06). In a bank, internal manuals or ticket exports fed to a support assistant can hide API keys, passwords or customer PII; once embedded, retrieval can surface them verbatim to any user who asks the right question. The control checks that the ingestion path scans content for sensitive material and that none leaks downstream. Targets are explicit: 100% of RAG documents scanned for secrets/PII pre-ingest, and 0 credential surfacing in RAG output. To implement, place secret- and PII-scanning (pattern and entropy detection, named-entity recognition) as a mandatory gate before chunking and embedding, redacting or quarantining flagged content and recording per-document scan results as evidence; add a complementary output filter that inspects generated responses for credential-shaped strings. Operate it by tracking scan coverage and monitoring outputs. Because both thresholds are absolute, any unscanned document or any credential appearing in output is a breach that blocks the ingest, purges the offending vectors, rotates exposed secrets, and triggers review of the source feed.