RAG retrieval boundaries
RAG cross-tenant exposure is an authorization bug on retrieved chunks, not a prompt-injection bug. If the index returns another tenant's text into a context you are allowed to see, the filter failed before the model spoke.
Skill: Agents, MCP, and retrieval
Ask: Is the tool token wider than the tool, or did retrieval return another tenant's text into a context I am allowed to see?
Stop: You can show the token audience or the retrieved chunk boundary. A confused answer with no authority behind it is not the report.
Checklists
- RAG retrieval boundaries - Retrieval is an authorization decision. If the index returns another user's chunk, the model did not cause that, the query did.
Disclosures
No public card yet.
Playbooks
- RAG document trust - Cross-tenant RAG is an authorization bug on retrieved chunks. If the index returns another tenant's text into a context you are allowed to see, the filter failed before the model spoke.
Questions
Is a foreign chunk prompt injection?
No. Prompt injection is a different hunt. This one is whether retrieval returns another tenant's chunk into a context you are allowed to observe.
The model refused to quote the chunk. Is there no bug?
If the retrieval layer already returned the other tenant's text to the application, the boundary failed even when the model stays quiet. Do not paste customer data into a report.
This page is the linked pack hunt_brief("rag") returns on the MCP connector. Authorized testing only.