isolation of calls and of the knowledge base (RAG), least access, never cross-session access; per-requester source segregation; output redaction.
The threat
the attacker draws data from another user or from the system's memory (data leakage, system prompt extraction, exfiltration) without necessarily cracking anything.
Angle mortWhy classic frameworks miss it
the boundary is no longer network or storage but session and reasoning: the system's memory (RAG, history, context) can leak between users or be extracted by a question.
MitigationProposed approach
isolation of calls and of the knowledge base (RAG), least access, never cross-session access; per-requester source segregation; output redaction.
The proposed control
no cross-session access and no system prompt extraction.
Expected evidence
prove that one session cannot read another's memory or extract the system prompt.