Safety & Security

Explanation

This safety and security control checks that only authorised, validated data is ingested into the system's vector store — guarding the knowledge base behind a RAG assistant against unauthorised, tampered or poisoned embeddings being inserted. It matters in BFSI because anything ingested into the vector store can later be retrieved and surfaced to customers or used to manipulate answers, so an attacker who can sneak unauthorised vectors in can effectively poison the assistant or smuggle in malicious content. It is measured by the Unauthorized Vector Ingestion Rate; the control data provides no calculation method, so implement it as the proportion of ingestion events that are unauthorised or unvalidated (unauthorised ingestions divided by total ingestions) and document the exact definition adopted. To implement and operate it, enforce authenticated, least-privilege write access to the vector store, validate and sanitise every document and embedding before ingestion, track provenance and signatures on each source, and place these checks in the ingestion pipeline; log every ingestion event with its source, authorisation decision and validation result as auditable evidence. The threshold is ≤ 1% (target 0) with an alert on any breach: ideally no unauthorised vector is ingested, and any confirmed unauthorised ingestion triggers an alert, quarantine and removal of the affected vectors, and investigation of how the write occurred.