How Secure-RAG works

Secure-RAG answers questions from an approved library of policies, procedures and regulatory references, while enforcing access, security, evidence and audit controls around generative AI. It is not a general-purpose chatbot: when approved evidence is insufficient, inaccessible or irrelevant, it says so rather than relying on the model's general knowledge.

The control path

Step	Control	Purpose
1	Redact personal data and secrets in the question	Keep identifiers out of logs, retrieval and the model.
2	Injection check on the question	Block instructions aimed at the assistant before anything is searched.
3	Server-side identity and authorisation	Only documents the identity may read are searchable. The index is not the authority for access.
4	Hybrid retrieval and relevance gate	TF-IDF and BM25, plus BGE-M3 semantic embeddings when a Hugging Face token is set; weak matches are discarded.
5	Passage quarantine	Retrieved text carrying instructions is treated as an attack and never reaches the model.
6	Grounded generation	The model receives evidence as untrusted data and must cite sources.
7	Answer checks	Citations must match retrieved sources; protected values and personal data are redacted.
8	Evaluation and audit	Grounding indicators and a hash-chained audit record for every request.

Pages

Ask	Governed answers per workspace with evidence (page and section), access decision, obligations and a claim-by-claim check.
Workspaces and documents	One workspace per client; upload PDF, Word, HTML, text or Markdown with access metadata; versioning, retention and deletion; obligations register and retrieval benchmark.
Breach Lab	Attack the built-in pipeline or an external RAG application; findings are remembered and replayed; Proof-of-Fix Records; CI release gate; schedules and alerts.
AI Trust Passport	Claims whose status is computed from test results or documents; expiring, revocable share links with view log.
Vendor evidence check	A vendor's documents checked against AI vendor controls with cited evidence, questions and suggested clauses.
Baseline security tests	11 end-to-end tests of this pipeline and live model challenges.
Answer quality	Grounding and citation metrics of recent answers.
Audit trail	Hash-chained events and chain verification.

Where Secure-RAG fits

Secure-RAG	What the authoritative sources say; whether a RAG application is secure
Agentic Risk Analyst	What can go wrong with an AI use case, and what to do
CALIBRE Governance Fabric	How much governance a system needs; register, approvals and evidence

Each works on its own. Connected, ARA's Compliance agent and the Fabric call Secure-RAG's /api/query for evidence.

Connecting real enterprise sources

The demonstration uses a synthetic library. A production deployment replaces or supplements it through controlled connectors that preserve source permissions and metadata.

Source	Typical integration	Important control
Microsoft SharePoint / Microsoft 365	Microsoft Graph API, scheduled or event-driven sync into an ingestion service	Synchronise ACLs, groups and classification; never flatten permissions.
Confluence	Atlassian REST API and webhooks, then parsing and chunking into the governed index	Map spaces, pages and user or group permissions to retrieval authorisation.
ServiceNow	REST or Table API for approved knowledge articles	Apply record-level authorisation; exclude operational secrets.
File repositories	Approved connectors for S3, Azure Blob, Google Drive, OneDrive or network shares	Preserve source, owner, classification, retention and access metadata.
GRC and policy platforms	API or export from the platform	Keep version, effective date, control owner and approval status.
Regulatory sources	Approved URLs, APIs or curated publications with provenance	Record source URL, retrieval date, version and jurisdiction; never treat an external page as internal policy.

External regulatory references in the library

The library holds paraphrased references to these pages, labelled "external reference". Validate current content and applicability before relying on them.

Limits

The demonstration library is synthetic. Before loading client documents, use persistent, access-controlled storage, set DEMO_ACCESS_CODE and API keys, and agree retention with the client.
Breach Lab results cover the tested scenarios, identities and configuration only. A pass is evidence for that test, not a certification.
The obligations register, claim check and vendor check are rule-based. They find candidate text; a person confirms meaning and adequacy.
Demonstration identities are chosen on the page; production must take identity from single sign-on.
Injection detection is pattern-based and will not catch every attack; the passage quarantine and answer checks are further layers, and the Security Lab shows which cases are covered.
The audit chain is tamper-evident, not tamper-proof.

Answers come only from the governed library and are decision support, not legal advice. Verify regulatory content against the regulator's current publication.