Why is 'the model is not a trust boundary' the core principle of secure RAG, and how do you build on it?

Asking the model to keep secrets or enforce permissions is asking the wrong component. The signal is enforcing access control before retrieval, in code you trust, and treating the LLM as untrusted compute over already-authorized data.

Updated Aug 2026 · Grounded in real Applied AI Engineer interview loops and written to a senior-engineer editorial bar.