Prompt Injection and Data-Leak Review Sign-off¶
Use this sign-off document to record the security review for RAG assistants prior to go-live, after onboarding a new data source, or following any system prompt modification.
1. Review metadata¶
- Assistant name:
${ASSISTANT_NAME} - System prompt version:
${PROMPT_VERSION} - Model deployment:
${CHAT_MODEL_DEPLOYMENT} - Review date:
YYYY-MM-DD - GenAI engineer:
${GENAI_ENGINEER} - Prompt lead:
${PROMPT_LEAD} - Security engineer:
${SECURITY_LEAD} - Decision:
[ GO / NO-GO ]
2. Review verification gates¶
Stage 1: System prompt architecture and instruction framing¶
- Context delimiter tags (
<context>...</context>) wrap all retrieved passages. - Explicit negative boundary instructions forbid the model from executing instructions embedded in context chunks.
- Automated secret scan confirms zero API keys, database connection strings, or internal URIs in prompt text.
- Direct system prompt extraction attempts return standard refusal responses without leaking prompt text.
Stage 2: Platform guardrails and Prompt Shields configuration¶
- Azure OpenAI Responsible AI (RAI) policy is bound to the target model deployment with User Prompt Attacks enabled.
- Azure AI Content Safety Prompt Shields (
text:shieldPrompt, API2024-09-01) is configured for indirect attack detection on document chunks. - Content filter blocklists and prompt attack detection modes (annotate or block) are verified in Microsoft Foundry.
Stage 3: Retrieval authorisation and data leakage prevention¶
- Azure AI Search queries enforce deterministic query-time security trimming (
$filter=search.in(security_groups, ...)). - Cross-tenant and cross-persona retrieval tests confirm users cannot retrieve documents outside their Entra ID group membership.
- Grounded response citations cite only chunks present in the query-time security-trimmed payload.
Stage 4: Red-teaming and tool permissions¶
- Automated adversarial evaluation suite (
snippets/eval/redteam_cases.json) executed with zero unmitigated High or Critical findings. - Planted injection test documents generated via
snippets/eval/make_injection_docs.pyare rejected or sanitised without hijacking generation. - Exposed tool schemas enforce strict parameter typing, forbid arbitrary command execution, and mandate human approval for write actions.
Stage 5: Rollback readiness¶
- Reversion mechanism (Azure App Configuration feature flag or Container Apps revision traffic split) is tested and verified to restore prior safe prompt version within 10 minutes.
3. Findings and triage log¶
| ID | Severity | Attack vector | Description | Status | Owner | Remediation |
|---|---|---|---|---|---|---|
| [SEC-01] | [High/Med/Low] | [Vector] | [Description] | [Open/Resolved] | [Owner] | [Remediation] |
4. Sign-off approval¶
| Role | Name | Decision | Signature | Date |
|---|---|---|---|---|
| GenAI Engineer | ${GENAI_ENGINEER} |
[Pending / Approved / Rejected] | [Signature] | YYYY-MM-DD |
| Prompt Lead | ${PROMPT_LEAD} |
[Pending / Approved / Rejected] | [Signature] | YYYY-MM-DD |
| Security Engineer | ${SECURITY_LEAD} |
[Pending / Approved / Rejected] | [Signature] | YYYY-MM-DD |