Which control BEST addresses the risk of unauthorized access to sensitive information when deploying an LLM with retrieval-augmented generation (RAG) connected to a corporate document repository?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because in a RAG architecture, the primary data exfiltration risk is the LLM retrieving and exposing documents the user is not authorized to see. Implementing access controls at the retrieval layer ensures that the document search is scoped to the user's permissions before documents are included in the LLM's context.
Full explanation below image
Full Explanation
B is correct because in a RAG architecture, the primary data exfiltration risk is the LLM retrieving and exposing documents the user is not authorized to see. Implementing access controls at the retrieval layer ensures that the document search is scoped to the user's permissions before documents are included in the LLM's context. A smaller model (A) does not prevent unauthorized retrieval; it merely reduces capability. Encryption at rest (C) protects documents from external access but does not control which authenticated users can retrieve which documents. MFA (D) authenticates user identity but does not limit what documents an authenticated user can access through the LLM.