Scenario 3
Preview — execution disabledRAG & retrieval securityIntermediateRAG Security Assessment
Treating every retrieved document as untrusted data, so a poisoned source cannot steer the answer.
Retrieval-Augmented Generation gives a model fresh context by fetching documents from a corpus and placing their text in the prompt. That is also its weakness: the corpus is not trusted, and any document in it can carry a hidden instruction aimed at the agent — an indirect prompt injection that lives in the data rather than in the user message. This scenario is a static architectural walkthrough of how a small pipeline scores the provenance of each retrieved document, detects conflicts between sources, and lets a verifier decide which context is trusted enough to ground an answer.
The guiding rule is that retrieved content is data, not commands, and that the model’s confidence in an answer is not evidence that the answer is grounded. What makes a piece of context trusted is its provenance and whether it survives conflict-checking against other sources — not how fluent or certain the generated text sounds.
Everything below is a conceptual example with a synthetic trace. No retrieval runs, no model is invoked, and the documents and scores are harmless and illustrative. The point is the mechanism — provenance scoring, conflict detection, context validation and a grounded answer — not a retrieval metric.
Honesty
Detecting a poisoned document is necessarily incomplete, exactly as injection detection is. That is why trust does not rest on detection alone: retrieved text can never authorize an action, and an answer is only emitted from context a verifier has validated.
Preview Mode — Execution Disabled
This laboratory is currently available for architectural exploration and educational demonstrations only. Live agent execution and security testing are disabled. Operational access requires prior explicit authorization from RavenRootviel.
Architecture
Components and flows
The agents, services, verifiers, policy engines and evidence stores in this scenario, and how they connect. Drag to pan, scroll to zoom, and select any component for its role, inputs and outputs.
Agents
Agents and responsibilities
Each agent has a narrow responsibility, explicit inputs and outputs, and — crucially — its own authorization posture. Reasoning is never authorization.
Retrieval Agent
Conceptual exampleTakes the user query and fetches candidate documents from the corpus, carrying each document’s source identity and ingestion path forward. It ranks for relevance only; it makes no trust judgement.
- Inputs
- User query (trusted channel) · Document corpus (untrusted data)
- Outputs
- Candidate documents with source metadata
- Tools
- Retriever over the corpus (relevance ranking)
- Authorization
- None — read-only retrieval; it returns candidates and takes no action on their content.
- Verification
- Relevance ranking is kept separate from trust: a highly relevant document is still untrusted data until its provenance is scored.
- Possible failures
- A poisoned document ranks highly for the query — expected; relevance is not trust, so this is handled downstream.
Provenance Scoring Agent
Conceptual exampleScores each candidate by the trustworthiness of its source and ingestion path (origin, signing/authority of the source, freshness) so later stages reason about provenance rather than about raw text.
- Inputs
- Candidate documents with source metadata
- Outputs
- Per-document provenance score + source trust label
- Tools
- Source-trust scorer (deterministic over metadata)
- Depends on
- retriever
- Authorization
- None — read-only; it labels provenance, it decides nothing about the answer.
- Verification
- Scores are derived from source/ingestion metadata, not inferred from the document body, so a document cannot raise its own trust by claiming to be authoritative.
- Possible failures
- Missing or lost provenance metadata for a source — fails closed to "untrusted / lowest trust".
Conflict Detection Agent
Conceptual exampleCompares the claims across retrieved documents and flags contradictions — where a low-provenance source asserts something that disagrees with higher-provenance sources, or carries an instruction-like span directed at the agent.
- Inputs
- Scored candidate documents
- Outputs
- Conflict set + candidate poisoned spans (hypothesis-level)
- Tools
- Claim-comparison heuristic (synthetic, illustrative)
- Depends on
- provenance
- Authorization
- None — produces hypotheses about conflicts, not decisions.
- Verification
- Its output is explicitly a hypothesis; a flagged conflict is resolved by the verifier, and an unflagged document is still gated by validation.
- Possible failures
- A subtle poisoning that agrees with legitimate sources is not flagged — mitigated by validation and grounding, not by the detector.
Context Validation Verifier
Deterministically decides which documents enter the trusted context: it drops sources below a provenance threshold, quarantines documents carrying agent-directed instructions, resolves conflicts in favour of higher-provenance sources, and abstains when a conflict cannot be resolved.
- Inputs
- Scored documents · Conflict set · Candidate poisoned spans
- Outputs
- Validated trusted context · ADMIT / QUARANTINE / ABSTAIN with a reason · Evidence record
- Tools
- Deterministic validation rule set
- Depends on
- provenance · conflict
- Authorization
- This IS the trust boundary for context. Retrieved text can never authorize an action; only provenance-validated, conflict-resolved context may ground an answer. Fail closed.
- Verification
- The decision is a pure function of (provenance score, conflict set, policy thresholds); it is reproducible and recorded.
- Possible failures
- Thresholds set too permissively admit low-trust context — a configuration risk, surfaced in the evidence record, not a model risk.
Workflow
Processing and decisions
The ordered path from input to recorded decision.
- 1
Retrieve with source identity
The user query drives retrieval over the untrusted corpus. Each candidate document is returned with its source identity and ingestion path intact — provenance travels with the data.
- 2
Score provenance, not prose
Each candidate is scored by the trustworthiness of its source, derived from ingestion metadata rather than from what the document says about itself.
- 3
Detect conflicts and instruction-like spans
Claims are compared across sources; contradictions and agent-directed instructions inside documents are flagged as hypotheses, with a reason.
- 4
Validate the context
The verifier drops low-provenance sources, quarantines documents that carry instructions aimed at the agent, and resolves conflicts in favour of higher-provenance sources — deterministically, deny-by-default.
- 5
Ground the answer, or abstain
An answer is produced only from the validated trusted context. If a conflict cannot be resolved or no source is trustworthy enough, the system abstains and returns UNKNOWN rather than a confident guess.
- 6
Record the evidence
Which sources were admitted, quarantined or caused abstention — and the provenance and conflicts behind each — is written to the evidence store. Model confidence is never recorded as evidence of grounding.
Example execution
Walk through an illustrative trace
A synthetic, predefined sequence — step forward and back to see what each component does, the evidence it produces and the decisions taken. This is a conceptual/synthetic trace, not an executed experiment, and it cannot be run live in this preview.
Step 1 / 6 · Retrieval Agent
Synthetic traceQuery and retrieval
For the query "what is the approved data-retention period?", the retriever returns two candidates: DOC-A from the internal policy source, and DOC-B from an open, unverified wiki mirror.
Evidence
Evidence in this scenario
What is recorded, of what kind, with what integrity property and from where. Demonstrative data — not cryptographic evidence of a real system.
Provenance scores
Provenance metadataIntegrity: Derived from source identity and ingestion path, not from document content
Provenance: Provenance Scoring Agent
Conflict and poisoned-span report
HypothesisIntegrity: Reasons attached; not treated as proof
Provenance: Conflict Detection Agent over scored, untrusted-labelled documents
Context validation evidence record
Evidence log entry (synthetic)Integrity: Append-only in a real deployment; demonstrative here
Provenance: Context Validation Verifier
Security controls
Authorization, validation and containment
The mechanisms that make the scenario safe by design, independent of what any model concludes.
Retrieved content is data, not instructions
Text fetched from the corpus is treated as untrusted data; a hidden instruction inside a document can never authorize an action or override the policy source.
Provenance / source-trust scoring
Each document is trusted according to its source and ingestion path, scored from metadata rather than from claims the document makes about itself.
Conflict detection and resolution
Contradictions between sources are detected and resolved in favour of higher-provenance sources; unresolved conflicts cause abstention rather than a guess.
Answer grounded only in validated context
An answer is emitted solely from context a verifier has admitted; the model’s confidence in its wording is not evidence that the answer is grounded.
Failure conditions
What can go wrong — and the expected behaviour
Honest failure modes and the containment or recovery that keeps a failure from becoming an unauthorized effect.
Poisoned document not detected
A subtle poisoning agrees with legitimate sources or evades the conflict heuristic and is admitted.
Recovery
Contained by design: retrieved text cannot authorize actions, so an undetected poisoned span becomes at most a content error, never an unauthorized side effect.
Provenance missing
A source’s ingestion metadata is lost and its trust cannot be established.
Recovery
Fail closed: the document is scored as untrusted / lowest trust and is not admitted to the grounding context.
Context conflict unresolved
Two sources of comparable provenance contradict each other and the verifier cannot decide.
Recovery
Abstain: the system returns UNKNOWN with the conflict surfaced, rather than presenting one side as proven.
Technical notes
Design considerations, limitations and references
- This is a conceptual architecture with a synthetic trace; no retrieval or language model is executed and the documents and scores are harmless and illustrative.
- Trust comes from provenance and conflict resolution, not from detection or from the model’s confidence — keep PROVEN, NOT PROVEN and UNKNOWN distinct, and abstain when a conflict is unresolved.
- The poisoned-document case is indirect prompt injection carried in retrieved data; the same origin-bound, deny-by-default principle is demonstrated at the prompt level in the Prompt Injection Detection scenario and the in-browser Prompt Injection Lab.
References
- OWASP Top 10 for LLM Applications — LLM01: Prompt Injection (indirect, via retrieved data)
- OWASP Top 10 for LLM Applications — LLM08: Excessive Agency
- ROOTVIEL — Prompt injection: when data becomes instructions (article)
Try this lab
Run it — coming soon
Interactive execution of this scenario is not part of the preview. When it is enabled, it will run on controlled, authorized scenarios only.
Live execution is not available in this preview. Access will require explicit authorization from RavenRootviel.
Authorized Access Only — Live Security Testing
Live security testing and agent execution require prior explicit authorization from RavenRootviel. The current preview provides educational content and non-operational demonstrations only. Browsing the educational content is public; operational use of the labs will require express authorization when it is enabled in a later phase. Access & use policy.