// RAG SECURITY GOVERNANCE FRAMEWORK · v0.1.0

BASTION-RAG

“We don’t block data. We govern its safe flow.”

A security layer that wraps your RAG pipeline and screens traffic in both directions — like an airport that checks passengers on the way in and luggage on the way out.

$ sentinel.check(query)  → PASS   0.3ms█

> view on github > explore modules

01 THREAT MODEL

Feeding private documents to an AI creates real attack surface.

Prompt injection hidden instructions override the model
PII leakage names, emails, IDs slip into responses
Cross-tenant exposure customer A’s data surfaces for B
Hallucination facts that exist in no source document
Intrusion queries that prove prior knowledge of secrets

02 SYMMETRIC PIPELINE

Every module that touches input also touches output. Bypass one layer and the next still catches you.

IN   query ──> Sentinel ──> Vault ──> Navigator ──> Anchor ──> [ LLM ]
                                                                  │
OUT  safe <── Sentinel <── Vault <───────────────── Anchor <──────┘

╰────────────────── Tracker observes every step ──────────────────╯

03 MODULES

SENTINEL

Bidirectional validation gateway

First and last line of defence. Detects prompt injection on the way in; catches PII re-emergence, hallucinations and permission violations on the way out. One engine, two configurations.

~0.3 ms in · ~0.9 ms out

VAULT

Two-phase privacy shield

Replaces 30+ PII entity types with tenant-scoped tokens before the LLM sees them, then restores values only for users their policy allows. Includes a cloud LLM connector.

tokenize → process → detokenize

PYTHON

NAVIGATOR

Tenant-isolated hybrid search

Filters by tenant before searching, never after. Fuses BGE-M3 vector and BM25 results with RRF, reranks, and can federate queries across deployments.

pre-filter isolation · RRF fusion

PYTHON

ANCHOR

Embedding security

Adds calibrated noise to embeddings at index and query time so stolen vectors can’t rebuild documents, and monitors responses for demographic bias with WEAT statistics.

differential noise · WEAT

GO + REACT

TRACKER

Observability & human-in-the-loop

Traces every event end to end into an HMAC-signed, tamper-evident audit log. Switch at runtime between off, observe and gate modes, where operators approve each stage.

audit · lineage · live dashboard

CROSS-CUTTING

+ DEFENCE IN DEPTH

Honey tokens · multi-tenancy · federation

Decoy records expose intruders across three layers. Tenant isolation is enforced independently in every module, so one failure never exposes data.

~1.2msadded latency

5security modules

~787test cases

<1%of LLM round-trip