Home

RSP — RAG Security Protocol

A protocol defining where security tools hook into a RAG pipeline and what they return.

Status: v0.2 proposal — pre-implementation. Nothing is frozen. The spec is the deliverable; the code in this repo is evidence that the spec works.

---

The shape of it

Two roles, three hooks, four verdicts, one wire format.

• Host — the RAG system. Calls plugins at defined points. Implements no detection itself.
• Plugin — a security tool. Receives content, returns a verdict. Runs as a subprocess.

chunked        ──→  on_chunk       ★ blocked here means it never enters the vector DB
                    ↓
               [ embedding ]
               [ storage ]
────────────────────────────────────
retrieval hit  ──→  on_retrieve    applies to already-stored content; injection scrubbing
response out   ──→  on_response    exfiltration checks (external links, MD images)

reserved: on_source (path-level), on_document (file-level)

ALLOW
REDACT(spans, replacement)    byte ranges to mask
FLAG(severity, reason)        pass through, tagged
BLOCK(reason)                 reject — not indexed / not returned

// → plugin
{ "hook": "on_chunk",
  "content": "AWS_SECRET_ACCESS_KEY=wJalr...",
  "metadata": { "source": "notes/aws.md", "chunk_index": 3 } }

// ← plugin
{ "verdict": "REDACT",
  "spans": [{ "start": 24, "end": 64, "type": "aws-secret-key" }],
  "replacement": "[REDACTED:aws-secret-key]",
  "severity": "critical" }

---

Why this and not the tools that already exist

Detection is a solved problem. Gitleaks ships 222 credential rules. Presidio does PII. rag-sanitizer catches prompt injection. All of them run at the gateway or at prompt time — never at ingestion — and none of them talk to each other.

The gap isn't detection. It's the absence of a place to plug detection in.

on_chunk is the hook that matters. Everything shipping today intercepts after the data is already in the vector store, where it stays recoverable via embedding inversion. Blocking pre-embedding means it was never there.

---

Pages

Page	What's in it
Proposal	The full v0.2 proposal: problem, hooks, verdicts, wire format, host choice, risks
Roadmap	10-day plan to v0.1, milestone exit criteria, what comes after, what never comes
Design Decisions	Decision log with rationales — read this before proposing a change
Open Questions	Unsettled items, each waiting on a conformance fixture
Development Practices	How protocol work differs from library work

---

The one criterion that counts

Someone can write a conforming plugin from SPEC.md alone, without reading the runtime source.

Tested at the end by handing the spec and conformance kit to someone with no context. If they have to ask questions or read the code, the spec isn't finished.