Control over AI
Start free trial
Blog
AI data leakage 8 min read

What is RAG, and how does it change your data risk?

Once an AI tool can search your own documents, the question moves from "what am I pasting in" to "what can it reach". That is a different kind of risk, owned by different people.

Admin reviewing which sources an AI assistant may search
Quick answer

RAG stands for retrieval-augmented generation: the tool searches a document collection first, attaches the retrieved passages to your question, and has the model answer from those. The model is not trained on them; it receives them per query. This solves stale knowledge and reduces fabrication, and it introduces one new problem: the reach of the search now determines what can appear in an answer. The question stops being what an employee types and becomes which sources the assistant can reach, and whether the permissions on those sources were ever correct.

01

RAG retrieves and attaches, it does not train

02

It reduces fabrication because there is a real source to point at

03

Risk shifts from input behaviour to authorisation on the sources

04

Permissions that were too broad for years suddenly become findable

05

Indexed documents age differently from documents in a folder

An organisation switches on an assistant that can search the intranet. The intent is modest: let people ask about leave policy without digging through folders. Two weeks later somebody asks about pay bands and receives a passage from a document that was opened up to the whole company by mistake three years earlier.

The assistant did nothing it was not permitted to do. That is the whole story.

What RAG is

RAG stands for retrieval-augmented generation. In plain terms: search first, then answer.

Four steps:

  1. Indexing. Your documents are split into chunks and converted into a form that supports searching by meaning rather than exact words. This happens once per document, usually into a vector database.
  2. Retrieval. When someone asks a question, the question is converted the same way and the closest-matching chunks are pulled back.
  3. Assembly. Those chunks are attached to the question, along with an instruction to answer from them.
  4. Generation. The model produces the answer, usually with a citation back to the source document.

The thing that does not happen: the model is not trained. It receives the text per query and forgets it afterwards, exactly like any other prompt.

What it solves

Two problems at once, which is why nearly every vendor now ships it.

Stale knowledge. A model knows nothing after its training cutoff and nothing about your organisation. With RAG it does not need to: the knowledge comes from a source you keep current.

Fabrication. Because real text accompanies the question, there is something to point at. That substantially reduces the problem described in why AI makes things up, without eliminating it: the model can still misread the retrieved passage or assert a connection the text does not support.

And one practical advantage that gets overlooked: you can remove a document from the index and it stops appearing in answers. With a model fine-tuned on your data, you cannot.

Where the risk moves

Here is the shift that catches organisations out.

Without RAG the question is: what does an employee type in? That is a behavioural question, with a moment and a person attached.

With RAG the question is: what can the assistant reach? That is an authorisation question, and it was already answered years ago by whoever set permissions on those folders and sites.

Those two questions have different owners and different fixes. The second is also the more uncomfortable one, because the honest answer is usually that nobody is entirely sure.

Over-broad permissions become findable. A site readable by "everyone in the organisation" was protected in practice by nobody knowing it existed. Searching took effort. An assistant searches everywhere at once and summarises. Same dynamic as with Copilot and SharePoint, and it is worth being precise: the assistant does not break anything. It surfaces what was already broken.

The index ages differently. A deleted document may persist in the index until the next crawl. An edited document can keep surfacing in its old form. That is a new category for your retention policy, and it rarely gets one.

Retrieved text goes to the vendor. Frequently skipped in assessments. The passages pulled from your own documents are attached to the prompt and therefore sent to the model. Everything that applies to ordinary prompts (storage, retention, the possibility of human review) applies to those passages too.

Five questions before switching it on

  1. Which sources are in the index? Not which ones you intended, which ones are actually there.
  2. Whose permissions does the search run under? Usually the user's. Sometimes a service account, in which case every user gets the same answer regardless of what they were entitled to see.
  3. Are those permissions still correct? This is the real work and it has nothing to do with AI. It is also why Microsoft puts remediating oversharing first in its own deployment guidance.
  4. How does a document leave the index? On request, automatically, or only at the next full crawl?
  5. What happens to retrieved text at the vendor? Same question as for any prompt.

Taken together: RAG moves the conversation from the employee to the configuration. That is mostly good news, because configuration is something you can get right once. It does not remove the employee. Someone chatting with that same assistant is still pasting in customer details that came from this morning's inbox, not from the index.

FAQ

Common questions

What does RAG mean?

Retrieval-augmented generation. The tool first retrieves relevant passages from a document collection, adds them to your question, and has the language model answer from them. The model does not learn the documents; it is handed them per query.

Is the model trained on our documents with RAG?

No, that is the point of the pattern. Documents are indexed and retrieved per query. The retrieved passages do travel to the model as ordinary text, so that provider's rules on processing, storage and retention apply to them.

Is RAG safer than fine-tuning on our own data?

On one axis clearly yes: remove a document from the index and it stops appearing in answers, whereas you cannot readily make a trained model unlearn something. On another axis no: the index makes findable what a folder structure was quietly hiding.

Why is authorisation the central issue with RAG?

Because the assistant searches with the permissions it holds, usually the user's. If those permissions were too broad for years, nobody noticed while searching required effort. An assistant searches everywhere at once and summarises the result.

What should we check before enabling RAG on company documents?

Which sources are in the index, whose permissions the search runs under, whether those permissions are still correct, how a document leaves the index, and whether retrieved text is stored at the AI vendor. Those five cover most of it.

Read next All in AI data leakage