Data classification: DataClassification enum and pattern detection
Define DataClassification enum: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED (PII, financial, health). Use regex patterns to auto-classify: RESTRICTED patterns include SSN (r'\b\d{3}-\d{2}-\d{4}\b'), credit card (r'\b\d{16}\b'), passport (r'\b[A-Z]{2}\d{6,9}\b'), health terms (diagnosis, prescription, patient); CONFIDENTIAL patterns include salary, api_key, password, secret; INTERNAL patterns include company email, internal/draft markers.
Data protection: operation-based handling rules
Apply different protections based on classification and operation context. RESTRICTED data: redact fully in include_in_context, log, and output operations. CONFIDENTIAL data: mask partially in include_in_context and output, redact fully in logs. INTERNAL data: pass through (no protection) in include_in_context and output, mask partially in logs. PUBLIC data: pass through all operations. Redact fully returns '[REDACTED]'; mask partially shows first 2 chars + asterisks + last 2 chars (e.g., 'ab****xy').
Secure context building: token budget and data protection
SecureContextBuilder builds agent context by: classifying each document using DataProtectionPolicy, applying operation-specific protection ('include_in_context'), combining protected documents with '---' separator, truncating to max_tokens * 4 characters (rough estimate). This ensures sensitive data is redacted before inclusion in LLM prompts while respecting context length limits.
MCP secure credential storage for OAuth tokens
Use OS-native secure credential storage for OAuth access and refresh tokens: macOS Keychain, Windows Credential Manager, or Linux Secret Service. Never store OAuth tokens in plaintext in MCP config files or application settings.
Document Provenance Tracking
Implement document provenance tracking to record who uploaded the document, when, from what source, and with what approval for every document in the RAG corpus.
Embedding Distribution Monitoring
Monitor embedding distribution statistics to detect adversarially crafted documents. A document whose embedding is unusually close to many different query clusters may be adversarially crafted.
Embedding Drift Detection
Implement embedding drift detection. If a document's embedding changes significantly after re-embedding with an updated model, investigate the change.
Multi-Model Embedding Cross-Validation
For high-security applications, use multiple embedding models and compare retrieval results. A document that ranks highly with one model but not others may be adversarially optimized for that specific model.
Treating Embeddings as Sensitive Data
Treat embeddings as sensitive data subject to the same access controls as source documents. Encrypt embeddings at rest and limit similarity query exposure by restricting top-k results and applying relevance thresholds.
Differential Privacy for Embeddings
For high-risk datasets (medical records, financial data, legal documents), consider adding calibrated noise to embeddings to reduce inversion risk based on Song & Raghunathan (2020) recommendations.
Access Control Metadata on Vector Chunks
Store access control metadata (classification, owner, permitted roles, permitted tenants) alongside every vector chunk, not just the source document.
Retrieval-Time Access Control Enforcement
Enforce access control checks at retrieval time, not just at ingestion time. Permissions may have changed since the document was ingested.
Multi-Tenant Isolation in Vector Stores
Implement tenant isolation in multi-tenant vector stores. Chunks from tenant A must never be retrieved by queries from tenant B.
Cascading Deletion from RAG Pipeline
Implement cascading deletion: removing a source document triggers removal of all associated chunks, embeddings, and cached responses.
Vector Namespace Isolation
Use separate vector namespaces, collections, or indices per tenant or classification level. Most vector databases (Pinecone, Weaviate, Qdrant, Milvus) support namespaces or collections for this purpose.
Query-Time Filtering for Chunk Isolation
Implement query-time filtering that enforces the querying entity's access boundaries before similarity search results are returned.
Per-Tenant Encryption of Chunks
Encrypt chunks at rest with per-tenant or per-classification keys where regulatory requirements demand it.
Cache Scoping by User and Permission Level
Scope cache by user, tenant, and permission level. A cached response for User A must never be served to User B unless they have identical access rights.
Cache Invalidation on Document Changes
Invalidate cache entries when source documents are updated, deleted, or have their permissions changed.
Cache TTL for Sensitive Data
Set maximum cache TTL (time-to-live) appropriate to the sensitivity of the data. Highly sensitive data should not be cached at all.
AI assistants send code context to model providers
AI coding assistants send code context (open files, project structure, terminal output) to the model provider's API. This context may contain credentials, personal data, proprietary business logic, and internal architecture details.
Do: Exclude sensitive files from AI tool context
Review what context your AI coding assistant sends to the provider—most tools document this. Configure AI tools to exclude sensitive directories from context by adding .env, .env.*, *.pem, *.key, credentials.json, serviceAccountKey.json, and similar sensitive files to your AI tool's context exclusion list (.cursorignore, .copilotignore, or equivalent). Audit what your AI coding tool sends by enabling request logging or using a network proxy to inspect outbound API calls. Use self-hosted or air-gapped AI coding tools for projects handling classified, regulated, or highly sensitive code. Store all secrets in environment variables, vault services, or encrypted secret stores—never in files within the project tree where AI tools can read them.
Don't: Expose sensitive data to cloud AI tools
Do not use cloud-hosted AI coding assistants on classified or top-secret codebases without approval. Do not assume that AI coding assistants only send the current file—many send broader project context. Do not open .env files or private keys in your IDE while an AI coding assistant is active, as file contents may be sent as context. Do not paste API keys, tokens, or credentials into your terminal while AI tools with terminal context access are running. Do not assume that .gitignore prevents AI tools from reading files—.gitignore only affects git, and AI tools read from the filesystem directly.