RAG / Document Firewall

Use this when documents, web pages, support tickets, PDFs, emails, Markdown, CSV, JSON, or HTML may enter a retrieval pipeline or agent context.

The RAG / Document Firewall scans content before it becomes trusted context. It labels, redacts, quarantines, or allows chunks while preserving provenance hashes for audit and deduplication.

What it checks

• Indirect prompt injection in retrieved content.
• Hidden instructions in HTML comments, scripts, styles, metadata, or invisible Unicode.
• Suspicious encoded fragments.
• Tool-hijacking language embedded in documents.
• External exfiltration requests.
• Secrets and sensitive data through local DLP.
• Source trust and provenance metadata.

Local-first defaults

• RAG_FIREWALL_ENABLED=true by default.
• Raw document and chunk text is not stored by default.
• Firefish stores hashes, decisions, redacted previews, DLP summaries, attack labels, and provenance metadata.
• High-risk chunks are quarantined instead of sent into trusted context.

Scan a document before indexing

curl -X POST http://localhost:8000/v1/rag/firewall/scan-document \
  -H "X-API-Key: change-me-local-dev-key" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "local-demo",
    "source_type": "markdown",
    "source_uri": "file://synthetic-support-note.md",
    "document_text": "# Support note\nThis safe synthetic note contains normal troubleshooting steps."
  }'

Python SDK

from firefish import FirefishClient

client = FirefishClient.from_env()

result = client.scan_rag_document(
    "# Support note\nThis safe synthetic note contains normal troubleshooting steps.",
    source_uri="file://synthetic-support-note.md",
    source_type="markdown",
)

print(result["overall_decision"], result["allowed_chunks"], result["quarantined_chunks"])

How to use the result

Index only allowed or redacted chunks. Keep quarantined chunks out of retrieval until a reviewer approves a safe version. Store source hashes with the chunk so Security Ops can explain which document influenced a decision without exposing raw unsafe content.

Firefish does not guarantee that every poisoned document will be detected. Use it with source controls, review workflows, retrieval isolation, and application-level authorization.