rag-cag-security
Security patterns for RAG and CAG systems with multi-tenant isolation. Use when building retrieval-augmented or cache-augmented generation systems that require tenant isolation, access control, and secure data handling.
When & Why to Use This Skill
This Claude skill provides comprehensive security patterns for Retrieval-Augmented Generation (RAG) and Cache-Augmented Generation (CAG) systems. It solves the critical challenge of maintaining multi-tenant isolation and data privacy in AI applications, preventing unauthorized data access and mitigating prompt injection risks through robust architectural patterns and sanitization techniques.
Use Cases
- Enterprise SaaS Development: Implementing strict multi-tenant isolation in vector databases using namespace or metadata filtering to ensure customer data never leaks across boundaries.
- Granular Access Control: Enforcing document-level permissions and user clearance levels to ensure AI agents only retrieve and process information the user is authorized to see.
- Prompt Injection Defense: Protecting LLM systems from 'indirect prompt injection' by sanitizing retrieved context and removing malicious instruction patterns before they reach the model.
- Data Compliance & Governance: Establishing structured data classification (Public, Internal, Confidential, Restricted) and audit logging to meet regulatory requirements for sensitive information handling.
| name | rag-cag-security |
|---|---|
| description | Security patterns for RAG and CAG systems with multi-tenant isolation. Use when building retrieval-augmented or cache-augmented generation systems that require tenant isolation, access control, and secure data handling. |
RAG/CAG Security Skill
This skill provides security patterns for RAG and CAG systems.
Multi-Tenant Architecture
Tenant Isolation Strategies
- Namespace Isolation - Separate vector namespaces per tenant
- Metadata Filtering - Filter by tenant_id at query time
- Separate Collections - Isolated collections per tenant
# Metadata filtering approach
results = vector_store.similarity_search(
query,
filter={"tenant_id": current_user.tenant_id}
)
Access Control
Document-Level Permissions
@dataclass
class Document:
id: str
content: str
tenant_id: str
access_groups: list[str]
classification: str # public, internal, confidential
def can_access(user: User, doc: Document) -> bool:
return (
user.tenant_id == doc.tenant_id
and any(g in doc.access_groups for g in user.groups)
and user.clearance >= doc.classification
)
Prompt Injection Prevention
def sanitize_retrieved_context(chunks: list[str]) -> str:
"""Sanitize retrieved chunks before including in prompt."""
sanitized = []
for chunk in chunks:
# Remove potential instruction patterns
cleaned = remove_instruction_patterns(chunk)
# Escape special characters
escaped = escape_prompt_chars(cleaned)
sanitized.append(escaped)
return "\n".join(sanitized)
Data Classification
| Level | Description | Handling |
|---|---|---|
| Public | Open information | No restrictions |
| Internal | Company-only | Tenant isolation |
| Confidential | Sensitive | Encryption + audit |
| Restricted | Highly sensitive | Need-to-know basis |
Security Checklist
- Tenant isolation implemented
- Document-level access control
- Retrieved content sanitized
- Audit logging enabled
- Data encryption at rest
- Secure API authentication