Enterprise RAG: Security and Scale
Multi-tenant RAG with document-level access control, PII handling, prompt injection defense, audit trails, and architectures that hold up under regulatory review.
Course Overview
The hardest problem in enterprise RAG is not retrieval quality, it is that the retriever is an extremely effective tool for leaking documents a user was never entitled to see. A vector index built over an entire SharePoint tenant will happily surface an HR investigation to a summer intern unless permissions are enforced at every stage. This course treats access control as a first-class design constraint rather than a filter bolted on at the end.
You will work through the architectures that actually hold: permission-aware indexing, per-user metadata filtering, tenant isolation strategies and their cost implications, and the reasons post-retrieval filtering is not sufficient on its own. Alongside that, the course covers PII detection and redaction in the ingestion path, data residency, and retention policy for indexes and logs, which frequently hold more sensitive text than the source system does.
The final part addresses adversarial behavior and evidence. Indirect prompt injection through poisoned documents is a live threat in any system that retrieves untrusted content, and defenses are layered rather than absolute. You will also build the audit trail that a regulator or internal auditor will ask for: what was retrieved, for whom, under what policy, and what the model was shown.
Duration: 3 days|Delivery: onsite, virtual, or hybrid
Prerequisites
- Production experience with RAG systems, or completion of Building Production-Ready RAG Systems
- Working knowledge of authentication and authorization models such as RBAC and ABAC
- Familiarity with cloud IAM on AWS, Azure, or GCP
- Understanding of your organization's compliance obligations is helpful
Who Should Attend
- Security architects reviewing an LLM system before it is approved for production
- Platform engineers building shared RAG infrastructure for multiple internal teams
- Engineering leads in regulated industries who must pass an audit before launch
- AI engineers whose pilot has stalled on data governance objections
Course Outline
- 1Threat model for retrieval systems: what an index leaks that the source system does not
- 2Permission-aware indexing: propagating ACLs from the source of truth into the vector store
- 3Query-time enforcement: metadata filters, pre-filtering vs post-filtering, and why post-filtering fails
- 4Multi-tenancy patterns: shared index, namespace-per-tenant, and index-per-tenant tradeoffs
- 5PII and sensitive data: detection, redaction, tokenization, and what to do with the originals
- 6Data residency and retention for embeddings, indexes, caches, and prompt logs
- 7Indirect prompt injection: poisoned documents, layered defenses, and realistic expectations
- 8Output controls: sensitive-content filtering, citation enforcement, and controlled refusal
- 9Audit trails: recording retrieved context, policy decisions, and model inputs for review
- 10Scaling architecture: sharding, replication, and index rebuild strategy at hundreds of millions of chunks
- 11Cost and performance at scale: tiered storage, cold indexes, and quantization tradeoffs
- 12Regulatory alignment: mapping controls to GDPR, HIPAA, and the EU AI Act
Learning Outcomes
- Design a RAG architecture where document permissions are enforced at retrieval, not after
- Choose a multi-tenancy model with a clear understanding of its isolation and cost profile
- Build a PII handling path that survives a privacy review
- Implement layered defenses against indirect prompt injection and articulate their limits
- Produce audit evidence showing who retrieved what, and under which policy
- Scale a vector index to hundreds of millions of chunks without losing filter performance
- Map your technical controls to the regulatory frameworks your organization is subject to
What You Will Build
- A permission-aware RAG reference architecture for your environment
- A threat model and control matrix for your retrieval system
- A PII handling and retention policy covering indexes, caches, and logs
- An audit logging schema suitable for internal or external review
Frequently Asked Questions
- Why is post-retrieval permission filtering not enough?
- Filtering after retrieval means the retriever has already ranked documents the user cannot see, so top-k is silently consumed by inaccessible content and results degrade in ways that reveal what exists. Worse, any bug in the filter, any caching layer, or any debug log exposes the content directly. The course covers pre-filtering and permission-aware indexing so restricted documents are never candidates in the first place.
- Can indirect prompt injection be fully prevented?
- No, and any vendor claiming otherwise should be treated with suspicion. Retrieved content is untrusted input reaching a model that cannot reliably distinguish instructions from data. The realistic posture is layered: input sanitization, privilege separation so the model cannot take consequential actions directly, output filtering, and monitoring. We cover what each layer buys you and where it fails.
- Should each tenant get its own vector index?
- It depends on tenant count, isolation requirements, and cost tolerance. Index-per-tenant gives the strongest isolation and the simplest audit story but scales poorly past a few hundred tenants and wastes capacity on small ones. Namespace partitioning within a shared index is the common middle ground. The course walks the tradeoffs with concrete numbers.
- Does this course cover the EU AI Act?
- It covers how retrieval-system controls map to EU AI Act obligations alongside GDPR and HIPAA, focusing on transparency, data governance, and record-keeping. It is engineering guidance for building auditable systems, not legal advice, and we say so plainly.
- What if our documents live across several systems?
- That is the normal case and the hardest part of permission propagation. The course covers reconciling ACLs across SharePoint, Confluence, object storage, and databases, and handling permission changes that must invalidate cached results.
Related Courses
Building Production-Ready RAG Systems
Take a RAG prototype to production: evaluation harnesses, incremental indexing, caching, latency budgets, and the failure modes that only appear at scale.
Securing AI Pipelines
Secure the infrastructure around your models: data provenance, artifact integrity, secrets, least-privilege access, and audit evidence across the ML lifecycle.
AI Model Security
Attack and defend machine learning models: adversarial examples, data poisoning, model extraction, membership inference, and defenses that survive contact with a real attacker.
Enterprise AI Governance and Compliance
Build an AI governance program that works: model inventories, risk tiering, approval gates, documentation, and control mapping to the EU AI Act, GDPR, and NIST AI RMF.
Ready to Get Started?
Contact us to schedule training for your team or inquire about upcoming sessions.