Retrieval Security, Deletion, and Freshness

A vector match does not grant permission. The subject making the request, the tenant and resource identities, device or session posture where applicable, policy revision, and current resource ACL must be resolved by trusted application code. The model must not infer that an employee may read a document, and a generated answer must not launder inaccessible content into an apparently ordinary summary.

Freshness is not one timestamp. Source-updated time tells when authoritative content changed; indexed time tells when a derived representation was built; request time sets the decision point. The artifact checks that the index is not older than its source revision, that ingestion lag stays within a declared limit, and that the indexed record is not too old at request time. Production systems also need a monotonic source/change sequence so clock skew cannot conceal a gap.

Deletion is a distributed workflow, not a boolean on one row. Search replicas, vector stores, reranker caches, prompt caches, observability payloads, evaluation corpora, and backups may have separate retention and purge semantics. Define which stores are in the serving path, how tombstones block reads while physical deletion completes, the service-level objective, and who can verify or escalate a missed purge.

Provenance should identify the source system, object, revision, ingestion event, transformations, and content digest. This supports replay, citation, revocation, and incident scope. It does not make every claim in the source true, prove that upstream authentication was uncompromised, or neutralize adversarial text.

Indirect prompt injection exploits the fact that an LLM can interpret retrieved data as instructions. Mark external content as untrusted, frame it separately, minimize available privileges, validate model outputs in code, and require user or policy approval for consequential actions. Never let a document grant itself tool permission. These controls reduce impact; they do not make prompt injection impossible.

• Rank relevance and source trust separately. High similarity is not authority or truth.
• Preserve citation identity through the final answer, but do not treat a citation as sanitization.
• Restrict retrieval ingestion rights and monitor unusual additions, duplicates, targeted query matches, and source-revision churn.
• Test poisoning and injection with realistic permissions and tools; a text-only sandbox misses the impact of excessive agency.

The teaching audit checks tenant, principal-or-group access, deletion, provenance, content/tool authority, then freshness for each ranked candidate. A malformed schema, stale digest, invalid timestamp, duplicate candidate, or mismatched request raises an exception before any policy report. A well-formed boundary failure blocks the entire result and returns no eligible chunk IDs; silently dropping one cross-tenant hit would hide an upstream enforcement defect.

Deterministic ordering makes replays and incident comparisons stable, but it does not imply later failures are harmless. After containing the first breach, continue the investigation across every relevant boundary and derived store.

1def audit_retrieval(
2    contract: GovernanceContract,
3    request: RetrievalRequest,
4    evidence: RetrievalEvidence,
5) -> GovernanceReport:
6    """Fail the whole candidate set when retrieval crosses a declared boundary."""
7    contract = validate_record(contract, GovernanceContract)
8    request = validate_record(request, RetrievalRequest)
9    evidence = validate_record(evidence, RetrievalEvidence)

example=illustrative_only
status=ELIGIBLE_FOR_CONTEXT_REVIEW
first_failure=none;action=review
eligible=chunk-a,chunk-b
claim=LOCAL_AUDIT_NOT_SECURITY_CERTIFICATION

The fixture contains one principal-authorized chunk and one group-authorized chunk inside a single tenant. All content, request, candidate, policy, source, and timestamp declarations are sealed. Focused tests cover cross-tenant retrieval, denied access, tombstones, unknown provenance, instruction/tool authority, stale indexes, future timestamps, request mismatch, duplicates, rank gaps, string subclasses, numeric type attacks, and recursive constructor bypass.

1. 01ContainDisable the affected index, tenant, source, tool, or release path; revoke credentials and block suspect content IDs without waiting for perfect root cause.
2. 02ScopeTrace source revisions through chunks, embeddings, replicas, caches, prompts, outputs, and tool calls. Preserve minimal authenticated evidence.
3. 03Purge and rebuildApply tombstones and ACL fixes, verify every serving replica and cache, then rebuild from an authoritative revision rather than editing one index in place.
4. 04RequalifyReplay authorization, freshness, poisoning, injection, and answer-grounding tests under exact repaired revisions before restoring traffic.

Operational dashboards should distinguish policy denials from malformed evidence, index lag from source lag, requested deletion from verified purge, and suspicious content from confirmed compromise. A reduction in retrieved results can be a healthy security response or a broken ingestion pipeline; keep denominators and cohort identities so the signal remains interpretable.