RAG Ingestion Security

A retrieval-augmented pipeline is only as safe as the files it ingests. A document that claims to be a PDF may be something else; a file approved yesterday may be swapped today. EVE governs the ingestion boundary: it detects the real media type from content, applies bounded safe-parsing limits, runs deterministic scanners, and blocks, quarantines, or requires approval before a file is ingested or used — emitting signed scan evidence.

Controls at ingestion

Content-based type detection — the real media type is determined from content, not the file extension or declared type.
Bounded safe parsing — parsers run under size and structure limits so a hostile file cannot exhaust resources.
Deterministic scanners — pattern and structure scanners decide BLOCK / QUARANTINE / REQUIRE-APPROVAL / ALLOW before ingestion.
Substitution protection — scan evidence binds the artifact digest to the decision, so a substituted artifact after approval is detected by verification.

Evidence example

scan evidence { final_action: BLOCK, findings_digest, completeness_status }
# verify_scan_evidence rejects an evidence whose artifact_digest was changed

Readiness

Deterministic artifact scanning with signed evidence and artifact-substitution protection are PILOT_READY; artifact governance is customer-pilot ready at supported boundaries (Python; embedded-service and sidecar modes), covered by the artifact-scan phase report (24 tests).

Limitations

Deterministic scanners are pattern and structure based. OCR, vision, and QR/barcode reading are probabilistic and are disabled by default (recorded as unavailable), and incomplete extraction is reported as partial — it cannot masquerade as complete.
Substitution is detected at verification time; enforcing re-scan-before-use is a wiring responsibility at the ingestion boundary.
Scanners cover the supported artifact boundaries; customers extend fixtures for their own content types.

Next step

Point your ingestion boundary at EVE in a pilot and inspect the signed scan evidence for blocked and quarantined files.