// tool 03

RAG Security Checklist

18 production-readiness controls across access control, retrieval integrity, and injection resistance. Check each item you've implemented.

// Progress

Your RAG is ~0% production-ready

Access Control0/6

Retrieval Integrity0/6

Injection Resistance0/6

01Access Control

01

User identity is passed to the retrieval layer, not just the LLM

02

ACL filters are applied BEFORE similarity search, not after

03

Cross-tenant namespace isolation is enforced at the vector store level

04

Service accounts have least-privilege access to vector collections

05

Embedding API keys are rotated on a schedule

06

Vector store access logs are retained and reviewed

02Retrieval Integrity

07

Chunk boundaries do not split across security-sensitive content

08

Document metadata includes original access classification

09

Retrieval results are filtered by classification before concatenation

10

Query logging captures user identity alongside the query

11

Re-ranking does not promote chunks from unauthorized namespaces

12

Citation/source attribution is included in LLM context

03Injection Resistance

13

Ingested documents are scanned for embedded prompt injection

14

Markdown/HTML in ingested content is stripped or sanitized

15

PDF metadata fields are treated as untrusted input

16

Web-scraped content passes through an injection filter before ingestion

17

Retrieval is sandboxed from tool-calling pathways

18

Output is validated against an expected schema before returning to user

We test the full retrieval chain — access controls, chunk boundaries, and injection vectors.

LogicLeak

ADVERSARIAL AI SECURITY

Adversarial AI security. We find the leaks in your AI systems before adversaries do.

// Navigate

// The Firm

// Threat Briefing

Sanitized findings from active engagements — one email a month, before they go public.

© LogicLeak 2026·Legal·Privacy·Terms·Contact