origin
tagged retrieval · source URI on every chunk
redact
→ rerank, default for regulated workloads
isolated
vector-store namespaces · cross-tenant fenced
gateway
integration · classifier on every chunk
Where the components live

Agent → Vector Store → Sentinel/Gateway → LLM. Retrieval origin tagged on the way through.

The agent issues retrieval calls through the Sentinel SDK; the SDK tags each returned chunk with its source URI, ingestion timestamp, and trust class. The Gateway runs the indirect-injection classifier and the entity-redaction pass before prompt assembly. The LLM sees the assembled, redacted, origin-attributed prompt.

Your environment

RAG agent · Sentinel SDK

The agent process. The SDK wraps the retrieval call and emits an origin-tagged chunk record per result.

Retrieval

Vector Store

Pinecone, Weaviate, Qdrant, Milvus, pgvector, OpenSearch, Vespa, or Bedrock Knowledge Bases. Namespaces fenced per tenant.

BladeRun Gateway

Tag · Classify · Redact · Assemble

Per-chunk indirect-injection classifier with origin attribution. Entity redaction at the retrieval boundary. Prompt assembled with redacted, attributed chunks.

External

Any LLM Provider

OpenAI, Anthropic, Bedrock, Vertex, or self-hosted. The model sees redacted prompts and attributed retrieval.

What runs at the retrieval boundary

Three passes between vector store and prompt assembly.

Each pass is independently auditable. A retrieval that fails any pass is dropped from the assembly, logged with provenance, and (if the score is high enough) escalated to source quarantine. The agent does not know, and does not need to know, about the dropped chunks beyond a count.

1

Origin tagging

Every chunk carries source URI, ingestion timestamp, ingestion-pipeline ID, and trust class. The LLM sees attribution alongside content.

Deterministic
2

Indirect-injection classifier on retrieved chunks

Structural classifier scores each chunk; instructions arriving via retrieval are flagged with retrieval origin, not user origin. Hits trigger drop, log, and (above threshold) source quarantine.

Classifier
3

Redaction passes · 12 entity classes

Boundary redaction tokenizes NPI in retrieved chunks before they are assembled into the prompt. Per-session deterministic tokens preserve coreference across the assembled context.

Deterministic
PineconeWeaviateQdrantMilvuspgvectorOpenSearchVespaBedrock KB
Configurations from the DLP Engine

Redact-then-rerank vs. rerank-then-redact.

Two pipeline orders are supported. The choice is a per-application configuration, not a platform-wide constraint. Most regulated workloads run the first; rerank-quality-sensitive workloads run the second.

Default · regulated workloads

Redact-then-rerank

Entity redaction runs immediately after retrieval, before the reranker sees the chunks. The reranker scores tokenized chunks. The model never sees raw NPI, even transiently inside the rerank stage. This is the default for GLBA-scoped workflows.

retrieve(top-k)
↓
redact · 12 classes · deterministic tokens
↓
rerank on tokenized text
↓
classify for indirect injection
↓
assemble + forward to model
Optional · rerank-sensitive

Rerank-then-redact

The reranker scores the original chunk text for higher fidelity, then redaction runs before the chunks reach the model. The exposure window is in-process and does not leave your perimeter, but it exists. Selected for cases where reranker quality on the original outweighs the in-process redaction window.

retrieve(top-k)
↓
rerank on original text
↓
redact · 12 classes · deterministic tokens
↓
classify for indirect injection
↓
assemble + forward to model
Connected to the rest of the platform

RAG deployment uses three platform components on the call path.

Use-case view

RAG without poisoning the retrieval channel

The business-outcome twin of this page: the risk shape, the regulatory mapping, the indirect-injection incident.

Read the use-case →
DLP Engine

Boundary redaction · 12 classes

The redaction engine that runs on retrieved chunks before prompt assembly. Configurable order; deterministic tokens.

Explore DLP →
Prompt injection

Direct + indirect classifier

The structural classifier the Gateway runs on every retrieved chunk, with retrieval-origin attribution.

Explore the classifier →
Common questions

What architecture teams ask first.

Which vector stores are supported on day one?
Pinecone, Weaviate, Qdrant, Milvus, pgvector, OpenSearch (with k-NN), Vespa, and the Bedrock Knowledge Bases native store. Integration is at the retrieval boundary. We do not sit inside the store, we sit between the retrieval call and the prompt assembly. Adding a new store is a connector, not a redesign; a self-hosted custom store can be wired in via the SDK's retrieve-hook in under a day.
Do we need to change our embedding pipeline?
No. Embeddings stay where they are. BladeRun governs at retrieval time, not at index time. If you choose to ingest with redaction-on-write for the most conservative posture, we ship a sidecar that runs on the ingestion pipeline and tokenizes before embedding, but it is optional. Most banks start with retrieval-time redaction and add ingestion-side as a hardening step.
What's the latency overhead on a retrieval-augmented prompt?
Under 15ms p95 added by the Gateway, including indirect-injection classification across the top-k chunks and entity redaction. The classifier batches across chunks; redaction parallelizes. For typical k=5 retrieval, per-chunk cost is sub-millisecond. The dominant latency on the request remains the retrieval call itself plus the model.
How do we configure redact-then-rerank vs. rerank-then-redact?
Per application config in the Gateway. The default is redact-then-rerank for any workload tagged GLBA-in-scope. Rerank-then-redact is selected for cases where the reranker's quality degrades unacceptably on tokenized text, typically high-fidelity research or summarization workloads where the originals never leave your VPC anyway.
How is the source URI on a chunk validated?
The SDK reads the source URI directly from the vector store's metadata (every supported store carries this). Trust class is computed from the ingestion-pipeline ID and the last-verified timestamp. Sources from unmonitored ingestion pipelines fall to the lowest trust class until promoted; promotion is a change-managed configuration step.
What happens to a chunk that fires the indirect-injection classifier?
It is dropped from the assembled prompt and logged with its score, fragment, and source URI. The agent receives a count of dropped chunks, not the content. Above a configurable score threshold, the source URI is flagged for quarantine and the data team is alerted; below it, the hit is logged for tuning. False-positive chunks are part of normal operation and visible in the dashboard.
Pilot the architecture

Wrap one retrieval call. See the boundary in production.

Drop the SDK in around your retrieval call. Point the model client at the Gateway. Origin tagging, classifier, and redaction run in shadow mode for the first week. We show you the per-chunk classifier hits, the redaction coverage, and the source-URI distribution on real production traffic.

Start a technical pilotRequest a technical session