User guide
What each menu item does, what you put in and what you get out. Secure-RAG answers questions only from approved documents, with access control and citations, and tests whether a RAG application (yours or a client's) leaks data or can be manipulated.
Start in two minutes
- Ask a question about the demonstration library, for example "When must enhanced customer due diligence be applied?". Change the identity to see access control: some documents are withheld from some roles.
- Open Breach Lab, create a built-in target, run it (everything passes), then set "planted_weakness": true in its configuration and run again to see findings. Fix it, replay, and open the Proof-of-Fix Record.
- Create an AI Trust Passport with a claim linked to that target and open its share link.
- Create a workspace, upload your own PDF or Word document and ask about it.
The demonstration library holds 28 short synthetic bank policies and paraphrased AUSTRAC and APRA references. Questions outside those topics (for example mobile phones or AI agents in general) correctly return "No evidence": upload relevant documents to a workspace to cover them.
Menu items
| Menu | What it does | Needs a language model? |
|---|---|---|
| Ask the governed library | Choose a workspace, an identity, a provider and the number of passages, then ask. You get: the answer with citations (or a quoted evidence summary when no model is available), a claim-by-claim check of each sentence, the access decision (how many documents the identity may search and why others were withheld), obligations found in the evidence, and each passage with its scores, version, page and SHA-256. "No evidence" means nothing relevant and permitted was found; the page shows the closest passages, the workspace topics and what to do. New question clears the form. | For a written answer only |
| Workspaces and documents | One workspace per client or engagement. Upload PDF, Word, HTML, text or Markdown with classification, department, permitted roles, version, effective date, owner and source. Duplicates are skipped; a same-titled upload replaces the old version. Set automatic deletion after a number of days, or delete the workspace. Each workspace has an Obligations register (duties split into actor, action, condition and deadline, in Excel or CSV), a Retrieval benchmark (recall@k, MRR, nDCG@k and abstention accuracy over a question set you can extend) and a list of knowledge gaps. | No |
| Breach Lab | Attacks a RAG application the way an insider or outsider would: cross-department leakage, bulk exfiltration, direct and indirect prompt injection, hidden instructions to call tools, combining harmless answers (mosaic), revoked access still visible, plus prompts imported from ARA's red team. Targets are the built-in pipeline on any workspace, or an external RAG application over HTTP (its address, how each test identity logs in, and the protected values each identity must not see). Every failure becomes a remembered finding; Replay re-runs it after a fix and issues a SHA-256 sealed Proof-of-Fix Record; the release gate (for build pipelines) fails while any high or critical test fails. Runs can be scheduled, post to a webhook and report to CALIBRE Governance Fabric. | No (yes only when a target uses a model) |
| AI Trust Passport | For an AI supplier answering customers' security questionnaires. Each claim's status is computed, not typed: verified (its linked tests passed), documented (a governing document), unverified or failed. Share it through a link that expires and can be revoked; every view is logged. Attack details are never shown to recipients. | No |
| Vendor evidence check | Upload a vendor's contract, terms and security pack to a workspace, then check 14 AI vendor controls (training on customer data, data location, sub-processors, incident notice, model change notice, audit rights, exit, human oversight, APRA access and others). Each control shows the cited sentence or "not found", a question for the vendor and a suggested clause; download as Excel. | No |
| Baseline security tests | Eleven end-to-end tests of this Secure-RAG pipeline (injection, leakage, citation integrity and others) with evidence, and optional live model challenges. | For live challenges only |
| Answer quality | Grounding, citation accuracy and claim support for recent answers. | No |
| Audit trail | Every request, upload, test and deletion in a hash-chained log, with a check that the chain is intact. | No |
| User guide | This page. | No |
| How Secure-RAG works | The eight-step control path, pages, how real enterprise sources are connected, and limits. | No |
| API and integration | Endpoints used by ARA, CALIBRE Governance Fabric and build pipelines, and how API keys map to identities and workspaces. | No |
For the server administrator
- Model answers: set one provider key (HF_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY or GEMINI_API_KEY). Hugging Face Inference Providers are paid from account credits; a token without credits fails with "402 Payment Required", and Secure-RAG then shows a quoted evidence summary instead of an answer.
- Storage: on Render's free plan the service sleeps after 15 minutes without traffic and local files are lost; workspaces, findings and passports are then gone. Use a paid instance with a disk and set SECURE_RAG_DB for client work.
- Access: DEMO_ACCESS_CODE protects every change; SITE_PASSWORD protects all pages; SECURE_RAG_TOKEN and SECURE_RAG_API_KEYS protect the API.
Limits
- Answers are decision support, not legal advice; verify regulatory content against the current official text.
- Breach Lab results cover the tested scenarios, identities and configuration at the time; a pass is not a certification.
- The obligations register, claim check and vendor check are rule-based; a person confirms meaning and adequacy.
Answers come only from the governed library and are decision support, not legal advice. Verify regulatory content against the regulator's current publication.