// GLOSSARY

RAG (Retrieval-Augmented Generation)

An architecture that enriches context by pulling relevant fragments from external documents or data sources while the model generates a response. It became widespread to overcome two basic limits of a language model: feeding the model's knowledge, bounded by training data and aging over time, with current, organization-specific data, and grounding answers in a verifiable source. So it is among the central components of the runtime chain in generative-AI applications. But where it adds value is also where it opens risk: RAG brings external content to the model and assumes that content is trusted. When that assumption breaks, a new attack surface arises; an instruction planted in a retrieved document can lead to indirect prompt injection, a knowledge base with a weakly drawn access boundary to sensitive-data disclosure, and an untrusted source to poisoning of the model's answer. The 'trusted source' assumption is both RAG's strength and its weakness; security testing asks which data reaches the model with what authority and boundary, and whether that data could be controlled by an attacker.