Security patterns for RAG and CAG systems with multi-tenant isolation. Use when building retrieval-augmented or cache-augmented generation systems that require tenant isolation, access control, and secure data handling.
Implements security patterns for multi-tenant RAG/CAG systems with tenant isolation, access control, and prompt injection prevention. Use when building retrieval-augmented systems requiring secure data handling across multiple tenants.
/plugin marketplace add jpoutrin/product-forge/plugin install rag-cag@product-forge-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
This skill provides security patterns for RAG and CAG systems.
# Metadata filtering approach
results = vector_store.similarity_search(
query,
filter={"tenant_id": current_user.tenant_id}
)
@dataclass
class Document:
id: str
content: str
tenant_id: str
access_groups: list[str]
classification: str # public, internal, confidential
def can_access(user: User, doc: Document) -> bool:
return (
user.tenant_id == doc.tenant_id
and any(g in doc.access_groups for g in user.groups)
and user.clearance >= doc.classification
)
def sanitize_retrieved_context(chunks: list[str]) -> str:
"""Sanitize retrieved chunks before including in prompt."""
sanitized = []
for chunk in chunks:
# Remove potential instruction patterns
cleaned = remove_instruction_patterns(chunk)
# Escape special characters
escaped = escape_prompt_chars(cleaned)
sanitized.append(escaped)
return "\n".join(sanitized)
| Level | Description | Handling |
|---|---|---|
| Public | Open information | No restrictions |
| Internal | Company-only | Tenant isolation |
| Confidential | Sensitive | Encryption + audit |
| Restricted | Highly sensitive | Need-to-know basis |
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.