RAG Corpus

Expanded Definition

A rag corpus is the retrieval layer behind retrieval-augmented generation: the documents, records, indexes, or other sources a model consults before it answers. It is not the same as the prompt, the model weights, or the vector database that stores embeddings. The corpus is the underlying information set that retrieval surfaces into context.

In security terms, the boundary matters. A corpus may include approved policy documents, product manuals, tickets, knowledge base articles, or connected data stores, but it should exclude material the model should not be able to retrieve or cite. The practical question is not just what content exists, but what is reachable, current, and trustworthy at inference time. That is why provenance and access scope are part of the concept, not just administration details.

Consensus is still forming on how tightly corpus governance should be separated from prompt engineering, but the operational reality is clear: retrieval quality and retrieval trust are inseparable. For identity-heavy environments, the corpus often overlaps with records that contain sensitive operational context, so access boundaries must reflect the real audience, not the broadest possible assistant use case.

Examples and Use Cases

RAG corpora appear in systems where the model must ground answers in current internal knowledge rather than relying on training data alone. In practice, that often means the corpus is a controlled window into enterprise content.

• An internal support assistant retrieves from approved knowledge articles and release notes so it can answer product questions with current details.
• A security assistant queries incident playbooks, configuration standards, and architecture diagrams so answers reflect the organisation’s own controls.
• A compliance copilot draws from policy documents and control evidence, but only from sources that have been reviewed for accuracy and retention status.
• A customer-facing agent uses a limited corpus of public documentation to avoid exposing private case notes or internal-only material.
• A privileged operations assistant relies on runbooks and change records, where stale or duplicated documents can create conflicting guidance if the corpus is not curated.

The common trade-off is breadth versus control. Expanding the corpus can improve coverage, but it also increases the chance of surfacing obsolete, duplicated, or unauthorized material. That is why the most useful corpora are usually curated by purpose, not assembled as a generic content dump.

Security Implications

The main security issue with a RAG corpus is that retrieval turns content into an active decision input. If the corpus contains outdated procedures, injected instructions, or material that should not be visible to the requesting user, the model can produce answers that are authoritative in tone but wrong in substance. That can mislead operators, distort decision-making, or expose restricted information through summarisation.

Another failure mode is provenance loss. If teams cannot trace where a retrieved passage came from, when it changed, or who approved it, they lose the ability to challenge an answer that looks plausible but was grounded in the wrong source. In regulated or high-impact workflows, that becomes a governance problem as much as an accuracy problem.

The practical symptom is often quiet drift rather than obvious compromise: answers become inconsistent across users, retrieval results change after content updates, or the assistant begins favouring stale but highly indexed material. In identity and access environments, that can have concrete consequences such as incorrect provisioning advice, exposure of internal process details, or misuse of sensitive operational knowledge.

Domain and Governance Relevance

In NHI and agentic AI contexts, the RAG corpus becomes part of the trust perimeter because an agent may act on what it retrieves. That changes the governance question from “Is the knowledge base accurate?” to “Which identities, tools, and workflows are allowed to influence agent behaviour through retrieval?” When the corpus includes runbooks, secrets-adjacent operational notes, or access procedures, retrieval control starts to look like a machine-identity governance issue.

This is especially important where autonomous or semi-autonomous systems can trigger actions after retrieval. A corpus that is acceptable for human self-service may be too broad for an agent with execution authority. The security boundary is therefore not just content classification, but who or what can retrieve, under what context, and with what downstream permissions.

For NHIMG, the core governance insight is that corpus management is a control surface. Ownership, review cadence, source approval, and retrieval scoping all shape whether the model remains aligned with authorised knowledge or becomes a channel for stale, overbroad, or indirectly privileged information.

Related resources from NHI Mgmt Group

• What is the difference between RAG access and MCP tool access?
• How should security teams govern RAG-powered IAM agents?
• What is the difference between an AI model answering IAM questions and a RAG-enabled IAM agent?
• When does RAG create more risk than it reduces in IAM?