📅 Book a 30-min Demo📞 Call/text (571) 293-0242

Securing RAG: Access Control, Provenance and Poisoning Defenses

Enforce permissions at retrieval time, sign what enters your knowledge base, verify citations and catch poisoned documents with harmless canaries

A cybersecurity course from ibl.ai (self-paced, 10 to 12 hours, free). A hands-on, self-paced course for security, platform and ML teams on securing retrieval augmented generation: permission-aware retrieval, ingestion controls, signed provenance, citation verification, and detecting poisoned documents with harmless canaries, taught from OWASP LLM08 and LLM04, NIST, MITRE ATLAS, CISA and the vector databases' own documentation.

Last updated:

Course description

Securing RAG teaches security engineers, AppSec and platform teams, ML engineers and security leaders to protect the retrieval layer of LLM applications and agents. You will map a RAG pipeline's write and read trust boundaries against OWASP LLM08:2025 Vector and Embedding Weaknesses and LLM04:2025 Data and Model Poisoning, MITRE ATLAS techniques such as RAG Poisoning and their mitigations, NIST AI 600-1 and the CISA AI Data Security guidance. In five labs on a small local pipeline with synthetic documents you retrieve a document you should not see, fix it with permission filters at query time and prove the fix with a test matrix, enforce the same rule with PostgreSQL row-level security for pgvector, sign what enters the knowledge base and catch in-place tampering, verify that answers cite only authorised sources, and plant a harmless canary document to detect and quarantine. The course ends with a RAG security design and test plan for a knowledge base you own. Last verified 2026-11-03.

About this course

A retrieval augmented generation (RAG) system answers from your own documents. It fails in two ways that matter to a security team: it can hand a user a document that user was never allowed to read, and it can repeat to everyone whatever someone planted in the knowledge base. This course teaches you to close both, organised around controls: the threat, the control, how to verify it and how to monitor it. It is grounded in the OWASP Top 10 for LLM Applications 2025 (LLM08 and LLM04), NIST AI 600-1 and the NIST AI RMF, NIST AI 100-2e2025, MITRE ATLAS techniques and mitigations, the joint CISA guidance AI Data Security, and the vector databases' own documentation. In five hands-on labs on a small local pipeline with synthetic documents you retrieve a document you should not see, fix it with permission filters at query time, sign what enters the knowledge base and catch tampering, verify citations, and plant a harmless canary document to detect and quarantine. The principles are vendor-neutral; where a control exists on ibl.ai, the course links the live documentation.

What you will be able to do

  1. Map a RAG pipeline's write and read trust boundaries, and name its threats using OWASP LLM08:2025 Vector and Embedding Weaknesses, LLM04:2025 Data and Model Poisoning, MITRE ATLAS techniques and the NIST AI 600-1 actions that apply to retrieval data.
  2. Enforce permission-aware retrieval: build query-time filters from the authenticated identity on the server, deny by default, re-check after retrieval, and choose between application filters, tenant partitions and database row-level or document-level security from the vector stores' own documentation.
  3. Prove access control works with an authorization test matrix, including negative tests and a deliberate break that shows the test can fail.
  4. Control what enters the knowledge base with scoped writers, separate review, least-privilege connectors, hidden-content scanning, and provenance metadata that is hashed and signed and verified at query time.
  5. Verify that answers cite only documents retrieved and authorised for the user, and block uncited, unsupported or out-of-scope citations before display.
  6. Detect poisoned documents with harmless canaries, quarantine them without destroying evidence, monitor retrieval with logs that name documents and versions, and run a knowledge base incident playbook aligned with NIST SP 800-61 Rev. 3.

Who this course is for

Roles: security engineers, AppSec and platform teams, ML engineers and security leaders who build, run or approve RAG applications and agents.

Sectors: any organisation that grounds LLM applications in its own documents, including enterprise, government, healthcare, financial services, legal and education.

Before you start: working knowledge of access control and logging, and enough Python to run short scripts. The labs need Python 3.10 or later and install one pinned library (qdrant-client 1.20.0); Docker is optional, for the pgvector row-level security example. All lab data is synthetic and supplied in the course, and every test is authorised self-testing on your own system.

Format

Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: five labs and a database worked example on a local pipeline, with an AI tutor that coaches each step from the output you paste.

Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on defensive labs, each ending in an AI assessment, and a capstone in which you write a RAG security design and test plan for a knowledge base you own, followed by a reading list.

Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.

Currency

Last verified 2026-11-03 against the OWASP Top 10 for LLM Applications 2025, the OWASP AI Testing Guide v1, NIST AI 600-1, NIST AI 100-2e2025, NIST SP 800-61 Rev. 3, the MITRE ATLAS data release 2026.10, CISA's AI Data Security (May 2025), the MCP security best practices, the Qdrant, Pinecone, Weaviate, Elastic, PostgreSQL and pgvector documentation, and the ibl.ai documentation. Lab code was tested with qdrant-client 1.20.0 on Python 3.12, and the worked example with pgvector 0.8.7 on PostgreSQL 18.6.

Guidance and tools are still changing. OWASP, NIST, MITRE and the vector database vendors revise their guidance and software often, and new attack techniques appear between releases. Check current versions before relying on any page or template, and test only systems you own or are authorised in writing to test. This course is training, not a security assessment of your systems.

Outline

  1. Section 0 · Start here

    • 0.1 Welcome and orientation

  2. Section 1 · Map the RAG attack surface

    • 1.1 Where RAG breaks
    • 1.2 What the frameworks ask, and your threat register
    • 1.3 Section 1 assessment

  3. Section 2 · Enforce access control at retrieval time

    • 2.1 Permission-aware retrieval, and the leak
    • 2.2 Fix it and prove it
    • 2.3 Section 2 assessment

  4. Section 3 · Control what enters the knowledge base

    • 3.1 Ingestion controls and provenance
    • 3.2 Answers that cite only what they may
    • 3.3 Section 3 assessment

  5. Section 4 · Detect, monitor and respond

    • 4.1 Detect poisoning with harmless canaries
    • 4.2 Monitor and respond
    • 4.3 Section 4 assessment

  6. Section 5 · Capstone and wrap-up

    • 5.1 Capstone: a RAG security design and test plan for your knowledge base
    • 5.2 Capstone assessment
    • 5.3 Reading list and next steps