AID-H-020: RAG Index Hygiene & Signing
Implement integrity, source-trust, context-policy, freshness, and retrieval-time authorization controls across RAG indexing and context assembly. Cryptographically bind chunks and embeddings, weight content by source trust, enforce document/chunk entitlements, and verify the approved context governance release before retrieved content reaches the model.
Scope boundary
Owns preventive RAG retrieval integrity, source trust, principal entitlement, context-source policy, freshness, and fail-closed context assembly before retrieved content reaches the model.
AID-D-014: AID-H-020 signs, authorizes, filters, and enforces RAG context assembly; AID-D-014 emits content, relevance, provenance, diversity, and coverage findings at the post-retrieval observation point. Detect reports retrieval risk, while Harden controls which chunks may enter context.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0059 Erode Dataset Integrity
- AML.T0066 Retrieval Content Crafting
- AML.T0070 RAG Poisoning
- AML.T0071 False RAG Entry Injection
- AML.T0085 Data from AI Services
- AML.T0085.001 Data from AI Services: AI Agent Tools
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0126 Automated Collection
- AML.T0130 AI Agent Response Biasing
MAESTRO
- Data Tampering (L2)
- Compromised RAG Pipelines (L2)
- Privilege Escalation (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM05:2026 Data and Model Poisoning
- LLM07:2026 Misinformation
- LLM09:2026 Vector and Embedding Weaknesses
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI06:2026 Memory & Context Poisoning
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.2 Indirect Prompt Injection
- AITech-7.3 Data Source Abuse and Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-12.1 Tool Exploitation
- AISubtech-6.1.1 Knowledge Base Poisoning
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- EDH: Excessive Data Handling
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Raw Data 1.1: Insufficient access controls
- Raw Data 1.7: Lack of data trustworthiness
- Raw Data 1.11: Compromised 3rd-party datasets
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.6: Intent Breaking & Goal Manipulation