Securing the RAG Corpus Itself

The CISO asked where the circulars lived. The SI pointed at a vector database on a shared cluster. The collection was named gov-all. It held circulars, scanned applications, a dump of an old helpdesk, and an intern's notes. There was no owner. There was a dashboard. That is not a corpus. That is a drawer.

Retrieval-augmented generation fails first as records management. The model only speaks what you retrieved, plus whatever it invents when you retrieve nothing useful. Securing RAG is securing ingest, identity at query, retention, and the right to erase. The embedding is not a magic anonymiser. If it can be related to a person, treat it as personal data.

This guide is for CISOs on 17 August 2026. Not legal advice. OWASP and NIST give vocabulary for retrieval abuse and poisoning. DPDP gives you purpose and erasure. CERT-In gives you logs when the index is used as a path. None of them will name your collection for you.

Prcept will not mix public circulars and live applications in one drawer. If a bidder's reference architecture is gov-all, mark it fail.

Split the drawer

Public, effective circulars. Authenticated officer notes. Live personal applications. Eval copies. Those are four collections with four owners and four ACLs. Combining them because the model 'likes context' is how a citizen desk recites a hostel address.

Name an owner per collection: a post, not a vendor. The owner decides ingest, effective dates, and retirement. Without an owner, nothing is ever removed, and poison stays.

Version the collection. A go-live must be able to say which digest of which collection grounded an answer. Otherwise you cannot reconstruct, and you cannot roll back a bad ingest.

Ingest is a change

Every document that enters a production collection is a change request. Scan it. Classify it. Strip instruction-like markup where you can. Record who approved. Joke motions, draft watermarks, and 'not for circulation' stamps do not enter the policy collection.

Uploads from citizens never enter the policy collection. They enter, if at all, a per-session or per-application space with the same ACL as the application. Yesterday's upload is tomorrow's indirect injection if you leave it lying around.

Re-embed on a schedule you can explain, and after a classifier change. Stale vectors of deleted files are how Section 12 conversations go badly. Deleting the PDF and leaving the vector is not erasure.

Corpus controls that actually bite. Prompt filters are hygiene.

Control	Where it lives	Fail mode
Query-time ACL	Index / query service	Filter described in English in the prompt
Ingest review	Owner + ticket	Cron job from a shared folder
Effective-date filter	Metadata mandatory	Old circulars outrank new ones by similarity
Retention / erasure	Object + vector + chunk table	PDF deleted, vectors remain
Tenant split	Separate collections	gov-all with a metadata hope

Query-time is the kernel

The only ACL that counts is the one applied before chunks are returned. If the service account can search everything and the prompt says 'only use the user's documents', you have built a mixer with etiquette.

Bind the query to an identity: citizen SSO for own records, officer SSO for the queue they own, public identity for public circulars. No anonymous search of personal collections, captcha or not.

Log retrieval ids, not necessarily the chunk text, into the 180-day ICT store. You need to know what was shown to the model. You do not need a second copy of the Aadhaar image in the SIEM. Redact.

• No gov-all.
• No ingest without an owner ticket.
• No vector without a source id and a class.
• No query without an identity.
• No leftover vectors after erasure.

Availability and poison

A flooded index is a denial of service on the desk. Rate-limit ingest. Quarantine bulk loads. The poisoning article next is the hostile-document version of this paragraph.

A deleted collection with no backup story is a denial of your own making. Backups are in scope for erasure clocks. Write that down before the first rights request.

If the index lives with a hosted processor, you have a residency and subprocessors story. Prefer an index you can turn off without asking a foreign abuse queue.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Metadata filters are enough.

Metadata filters that the query service cannot skip are enough. Filters the model is asked to respect are not.

We will embed everything and decide later.

Later never comes, and erasure becomes archaeology. Classify at ingest or do not ingest.

Vector DBs cannot do ACLs.

Then they cannot hold personal collections. Use a store that can, or pre-filter identifiers in an application layer you control — and test that it cannot be bypassed.

Owners will slow ingest.

Yes. That is the point. A slow clean corpus beats a fast drawer.

A three-week corpus hardening

Start by naming collections. Do not start by tuning chunk size.

1. Week 1: inventory every collection, source, and identity that can query it.
2. Week 1: split mixed drawers. Stop ingest on gov-all.
3. Week 2: mandatory metadata — source id, class, effective date, owner.
4. Week 2: query-time ACL proven with a cross-citizen test.
5. Week 3: erasure path for object + vector + chunk. Drill one principal.
6. Week 3: retrieval logging without raw PII. CISO and DPO sign.

How this shows up in the file

Subject: RAG corpus register — agent [name].

Collections: [list with owners and classes]. Mixed collections: none. Query ACL: enforced in [service], proven [date]. Ingest: ticketed, no citizen uploads into policy. Erasure: object, vector, chunk, backup clock. Retrieval ids logged 180 days in [location], chunk text not shipped to SIEM. Prompt filters are not listed as ACL. Not legal advice.

A new collection is a change request.

Embeddings are not anonymous

If a vector can be related to an identifiable person, treat it as personal data. Deleting the PDF and leaving the chunk table is an incomplete erasure. Backups of the index are in the same map. Write the clock before the first Section 12 letter, not after.

Do not send live application text to a public embedding API 'just for quality'. That is a transfer of whatever you typed. For public circulars you can write a processor story if you must. For hostel records you usually cannot defend it.

Chunk size is an ACL decision. Two citizens in one chunk means one query can spill the second. Keep the atom small enough that a deny on one principal cannot leak another. Retrieval quality is second. Saturday morning is first.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Securing the RAG Corpus Itself” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “RAG security government” real. If the only control is a network diagram from last year, you have a story, not a threat model.

If the index holds it, the agent can be talked into saying it. Secure ingest, query-time ACL, and a corpus owner. The model is downstream. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Securing the RAG Corpus Itself” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “RAG security government” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next file must contain

“Securing the RAG Corpus Itself” earns a line in the noting only if a P4 Security/CISO can attach proof of “RAG security government.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “RAG security government.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.