Imagine an employee asks, “What is the petty cash limit for the sales department?” and instead of searching dozens of files, an AI assistant answers by pointing to the exact clause in the policy. This is what RAG (Retrieval-Augmented Generation) builds. The idea is attractive, but implemented without security design, it can put confidential information in the wrong hands.
How does RAG work?
A language model does not know your company’s documents on its own. RAG solves this in two stages:
- Preparation: Documents are read, split into small pieces (chunks), and each chunk is converted by an embedding model into a numeric vector that represents its meaning. These vectors are stored in a vector database.
- Answering: The user’s question is also converted into a vector, the closest chunks are retrieved and passed to the language model along with the question. The model writes its answer based on those texts and cites the source.
The main advantage is that adding new knowledge does not require retraining the model; you simply add the new document to the repository.
Benefits
- Fast access to policies, technical documentation, template contracts and frequently asked questions.
- The source of each answer can be shown, which makes checking accuracy easier.
- Less dependence on the few people who “know everything.”
- It can run entirely on an in-house server if both the language model and the embedding model are local.
Key risks
- Leakage through permissions: The biggest risk is pouring all documents into one repository so the assistant summarizes executive salaries or a confidential contract for anyone who asks. Each document’s access level must be enforced at retrieval time, not just on the original folder.
- Wrong answers: RAG reduces model errors but does not eliminate them. If the wrong chunk is retrieved or a document is incomplete, the model may confidently give a wrong answer.
- Outdated documents: If an old version of a policy is not removed, the assistant may answer from it.
- Prompt injection: Text hidden in a document or email can push the model into unintended behavior, especially if the assistant also has access to tools or other systems.
- Data leaving the company: If the language model or embedding model is a cloud service, document chunks are sent to it. Check that service’s data retention terms.
- Logs: Users’ questions can themselves be sensitive and should be treated as confidential data.
Before adding any folder to the RAG repository, ask yourself: “Am I willing for everyone who has access to the assistant to read this document?” If not, either leave it out or implement document-level access control.
A safer design
- Start with a limited, non-sensitive set, such as general IT documentation or common staff questions.
- Authenticate users through Active Directory and map access groups to documents.
- Assign each document an owner and a review date, and have a process for removing obsolete versions.
- Build a test set of questions with correct answers, and measure answer quality against it after every change.
- Limit the assistant’s access to other tools, such as sending email or changing data, as much as possible.
- Back up the vector database and its configuration, and secure the server like any server holding confidential data.
Checklist
- The scope of allowed and excluded documents is written down.
- User access levels are enforced at retrieval time.
- Every answer shows its source.
- Documents have an owner, a review date and an update process.
- The path of any data sent to external services is clear and approved.
- A test question set exists to measure quality.
- Logs and the vector database are protected and backed up.
ITPlus724 engineers can prepare the server, network, Active Directory integration, access control, security and backup your company needs to host such a system.