Knowledge Augmentation and Retrieval

GAIPS · 25 questions

• A 311 RAG assistant indexes an internal SharePoint library that includes HR investigation notes. What corpus-scoping control should security require first?
• A county assessor's vector database lacks tenant isolation between public parcel FAQs and sealed appraisal notes. What isolation control should security enforce?
• A permitting RAG system returns confidential building plans because document ACLs were checked only at portal login, not at retrieve time. What authorization gap should appsec close?
• A resident uploads a forged 'new fee schedule' PDF into an open bucket that continuously feeds the city's permitting embeddings. What RAG threat does this illustrate?
• Transit ops embed official GTFS feeds plus unofficial blog posts, and the rider assistant prefers the blog for detour advice. What knowledge-source control should security prioritize?
• Public-health staff chunk clinic PDFs for RAG without stripping hidden prompt-like instructional text. What ingestion hygiene step is missing?
• A court-clerk RAG assistant cites a superseded local rule because embeddings were never rebuilt after the rulebook update. What lifecycle control failed?
• A housing-authority RAG service logs full retrieved chunks—including resident SSNs—into debug traces. What data-path risk should security remediate?
• A library open-data RAG allows cross-collection search that mixes youth-services records with general catalog FAQs. What segregation control is needed?
• City security tests whether department and classification metadata filters on similarity search are enforced only if the client sends them. What finding indicates a control failure?
• Emergency management RAG pulls live weather APIs through a mirrored cache that an attacker has poisoned. What trust-boundary issue should security highlight?
• A water utility stores embeddings of valve manuals on a vector service left on default public networking. What infrastructure exposure should security fix?
• A school-district RAG stores student names as plain metadata fields used as retrieval keys. What minimization control should privacy and security require?
• Appsec finds that a high top-k setting causes a parcel FAQ bot to overshare adjacent dispute notes. What retrieval-tuning tradeoff should they address?
• County FOIA staff note that the RAG bot's citations omit document version IDs needed to defend public-records responses. What retrieval-answer property is missing?
• A parks chatbot's hybrid BM25-plus-vector ranker is skewed by keyword-stuffed volunteer wiki pages. What RAG abuse pattern should security recognize?
• IT swaps the embedding model for ordinance RAG and nearest neighbors for key sections change, but no retrieval evaluation is rerun. What change-control gap exists?
• 311 engineering caches embeddings of every ticket indefinitely, including resolved sensitive cases. What retention control should security require?
• Security reviews RAG prompt templates for a permitting bot and finds retrieved context concatenated with no delimiter from user instructions. What structuring control reduces context/instruction confusion?
• Housing caseworkers need RAG that never surfaces another resident's notes when retrieving for the open case. What authorization design is required?
• A city open-data portal ships an unauthenticated embedding-search demo pointed at internal draft policy corpora. What exposure should security stop?
• Transit RAG redacts sensitive fields in the UI display but still embeds the unredacted source chunks. What sequencing flaw remains?
• A county bot uses multi-hop retrieval that chains across departments without purpose limitation. What privacy principle should constrain the design?
• Public-health leaders ask whether grounded RAG alone is enough to skip human review for outbreak notices. How should security judge residual risk?
• Appsec deletes a sensitive PDF from object storage but finds its vectors still return in similarity search. What consistency control is missing?