Lesson deck
RAG security, reliability and release flashcards
Reviewing needs JavaScript. You can read every card in the list below.
Loading your cards...
Back to the lesson5 cards in this deck
Read all 5 cards as a list
- Front
- Where do you enforce document permissions in RAG?
- Back
- At retrieval: store ACLs as metadata, filter by user or group at query time, and verify on the final context. Never rely on the prompt to hide data, and key caches on tenant, permissions and document version.
- Front
- Reranker is slow or down: what do you degrade first?
- Back
- Skip the rerank and serve hybrid retrieval results, a small known quality loss. Do not drop retrieval or permission filtering. If retrieval is empty or weak, abstain or ask a clarifying question.
- Front
- Order the release path for a RAG change (chunker, embedder, prompt, model).
- Back
- Offline eval gate on quality, latency and cost, then shadow traffic, then a small canary, then full rollout, with rollback through an alias or feature flag. Version every component.
- Front
- A user asks for their data to be deleted. Where must the deletion reach in a RAG system?
- Back
- Vectors, caches and logs, not only the source store. Check your legal requirements.
- Front
- Which parts of a RAG system do you version for release?
- Back
- Everything that can change behaviour: prompts, embedding model, chunker, index, reranker and LLM. Put changes behind feature flags so rollback is one switch.