What it means
Retrieval-augmented generation combines a generative model with selected external information to ground responses in current or controlled sources.
Why it matters
Retrieval adds a new trust boundary: poisoned, unauthorized, stale, or irrelevant context can steer the model while appearing authoritative.
Practical focus
- Define the approved purpose, accountable owner, users, operating environment, and acceptable risk for retrieval-augmented generation architecture before implementation or procurement
- Implement source allowlists, authorization-aware retrieval, index hardening, context filtering, citation checks, and freshness controls through documented architecture, policy, configuration, and change control
- Collect retrieval traces, source and permission logs, grounding evaluations, stale-content findings, and citation accuracy and compare the results with approved requirements, risk thresholds, and expected outcomes
- Exercise this failure scenario as a planned test: a malicious document enters the index and injects instructions that change the model's behavior
Common mistakes
- Using the label retrieval-augmented generation architecture without defining the exact system boundary, decision, data, and people in scope
- Treating a model response or vendor claim as sufficient evidence without testing the surrounding application and operating process
- Failing to preserve retrieval traces, source and permission logs, grounding evaluations, stale-content findings, and citation accuracy in a form that lets reviewers reconstruct decisions and changes
- Testing only the normal path and never rehearsing what happens when a malicious document enters the index and injects instructions that change the model's behavior
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: