Retrieval-augmented generation (RAG) is the pattern of retrieving relevant documents or records at query time and supplying them to a language model as context, so its answer is grounded in specific source material rather than in training data alone. It is the dominant approach for connecting models to enterprise data.
- Retrieves source material at query time and supplies it to the model
- The dominant pattern for grounding models in enterprise data
- The primary source of indirect prompt injection exposure
- Retrieval scope determines what a single answer can expose
Why is retrieval-augmented generation important?
RAG matters twice over: it is how most enterprises connect models to their own data, and it is the primary source of indirect prompt injection exposure. The same mechanism that makes a model useful on internal information is the mechanism by which attacker-written text reaches the model.
The injection path is straightforward once stated. Retrieval pulls a document into context. The model reads that document as material to reason over. If the document contains instructions rather than information, the model has no reliable way to tell the difference. Any content reachable by retrieval – a shared file, a wiki page, an inbound email – becomes a channel into the model's reasoning.
The second exposure is scope. Retrieval decides what the model can see for a given query, and over-broad retrieval means an answer can surface records the requesting user was never entitled to. Nothing malicious has to occur; the system worked as configured and the configuration was too generous.
What is retrieval-augmented generation?
RAG is an architecture that supplements a model's parametric knowledge with material fetched at query time. Rather than relying on what the model learned during training, the application finds relevant source content and includes it in the prompt.
Four stages make it work. Ingestion processes source documents, typically splitting them into chunks. Indexing stores those chunks with embeddings that allow similarity search. Retrieval takes a query, finds the most relevant chunks, and assembles them into context. Generation passes that context and the query to the model, which produces a grounded answer.
The security-relevant properties sit in retrieval and ingestion. Ingestion determines what is in the corpus at all, including anything a user or an external party could write into a source system. Retrieval determines what reaches the model for a given request, which is the enforcement point for whether the requesting identity should see it.
RAG reduces hallucination and does not eliminate it. A model can still misread retrieved material or blend it with training knowledge.
Types of retrieval-augmented generation
Implementations vary by how retrieval is performed and by how much the model directs it.
Vector retrieval uses embedding similarity to find semantically related chunks. It is the default pattern and it can return material that is topically close and contextually wrong.
Hybrid retrieval combines vector similarity with keyword search, which improves precision on names and identifiers where embeddings are weak.
Graph-based retrieval traverses structured relationships between entities rather than matching text, which suits corpora where connections carry the meaning.
Agentic retrieval lets the model itself decide what to search for, issue multiple queries, and refine. It produces better answers on complex questions and widens the exposure surface, since the model rather than the application is choosing what enters context.
Permission-aware retrieval cuts across all four: retrieval filtered by the requesting identity's entitlements, so the corpus a query can reach matches what the user could open directly. It is the single most effective control in a RAG deployment and frequently the last one implemented.
Retrieval-augmented generation & Onyx
Onyx inspects retrieved context on the way into the model, which is where indirect prompt injection through RAG is actually caught. A poisoned document surfaced by retrieval is evaluated before the model reasons over it rather than after the resulting action has been taken.
Enforcement continues past inspection. Sensitive data detection applies to retrieved content as well as to prompts and completions, so material that should not reach a given requester can be masked rather than passed through. Where retrieval is agentic and the model issues its own queries, those queries are tool calls, which brings them under the same action-boundary controls as any other tool use. Runtime and prompt injection defense covers the inbound path.
