Why this environment matters
A retrieval-augmented generation gateway supplies a language model with documents and search results. The key risk is that retrieved content can contain instructions while the requesting user has access to only part of the underlying collection. This concept binds retrieval to the user’s authority and keeps document text separate from tool permissions.
The security challenge
A proposed gateway would associate each request with an authenticated user and an allowed resource set. Search would operate within that set rather than retrieving broadly and hoping the final answer removes restricted information. Retrieved passages would retain document identifiers so the response can be traced back to the material used.
How the capsule model could help
NØNOS could isolate document parsers, retrieval connectors and response assembly. A connector would hold only the credentials needed for its approved collection. Text returned by that connector would not be able to grant access to another repository or create an outbound network capability. These controls would constrain possible actions even when the model follows a malicious instruction. Operating-system isolation does not establish factual correctness or reliable resistance to prompt injection. An answer may quote too much, infer sensitive information or misinterpret a permitted document. The application still needs response controls and an evaluation set reflecting its actual data and users. The prototype should also examine cached results and conversation history. A retrieval cache shared across users can undermine careful connector permissions if its entries lose their access context. A new request should not inherit documents retrieved under somebody else’s authority merely because the question is similar.
Deployment requirements
This proposal concerns resource access around a model. It does not make model output trustworthy, provide automatic data classification or establish a compliant enterprise AI service. Connector support and identity integration remain implementation work. Evaluation requirements: Place adversarial instructions in a test document and verify that they cannot enable a new connector or outbound endpoint. Ask equivalent questions as two users with different access and inspect both retrieval results and cache behavior. Remove document access during a session and test the defined policy for subsequent retrieval and stored context.
Current public-beta limitations, hardware support and application availability must be assessed before any pilot. Neither this use case nor an industry source establishes NONOS certification or a current customer deployment.
Authorise before retrieval, then check what leaves
A proposed gateway would associate each request with an authenticated user and an allowed resource set. Search would operate within that set rather than retrieving broadly and hoping the final answer removes restricted information. Retrieved passages would retain document identifiers so the response can be traced back to the material used.
NØNOS could isolate document parsers, retrieval connectors and response assembly. A connector would hold only the credentials needed for its approved collection. Text returned by that connector would not be able to grant access to another repository or create an outbound network capability. These controls would constrain possible actions even when the model follows a malicious instruction.
The model can still produce an unsafe or wrong answer
Operating-system isolation does not establish factual correctness or reliable resistance to prompt injection. An answer may quote too much, infer sensitive information or misinterpret a permitted document. The application still needs response controls and an evaluation set reflecting its actual data and users.
The prototype should also examine cached results and conversation history. A retrieval cache shared across users can undermine careful connector permissions if its entries lose their access context. A new request should not inherit documents retrieved under somebody else’s authority merely because the question is similar.
Who could buy or integrate it?
- Enterprise search teams procuring governed retrieval services for internal assistants
- RAG platform vendors integrating permission-aware gateway infrastructure
- Specialist AI integrators building retrieval systems for regulated organisations
Industry examples: Elastic, Pinecone. These are research prospects, not represented as NONOS customers, partners or endorsers.