The First Gate, Reassembled
A retrieval-based LLM system can now be viewed as one connected path: an external item is admitted to a corpus, ranked against a user query, placed into context, interpreted by a model, and possibly carried toward an answer or action. This chapter reconnects those already-established relationships and turns them into a practical judgment. For any request, the important questions are what entered the corpus, what crossed the top-K boundary, what influence was observed, and what authority remained outside the model.
That sequence is more useful than a simple label such as “the system was prompt-injected.” It tells us where the failure occurred and what evidence would demonstrate it. A poisoned item can exist without being retrieved. It can be retrieved without changing the model’s response. It can change an answer without being allowed to call a tool. Those outcomes are not equivalent, and a serious security assessment must preserve the differences.
One request, seen as transitions
Consider a user asking a retrieval-augmented application to summarize a set of internal records. Before the request arrives, the records already have a history: someone created them, an application admitted them, and an indexing process made them available to the retriever. The user does not see all of those decisions. The model does not own them either. They are part of the corpus’s state and the source owner’s responsibility.
When the user submits the request, the application creates a retrieval condition. The query is represented in the form used for comparison, and the retriever scores corpus items against it. This is not yet a model-behavior event. It is a competition among candidate records. An item that is semantically close enough can move upward in the ranking; an item below the cutoff remains outside the context for that request.
The transition from ranked candidate to context is the first gate. It is the point at which a document changes from something the application could have found to something the LLM can read while producing its response. The gate is controlled by the query, the corpus, the embedding model, the scoring rule, and the selected top-K cutoff. None of those variables, by themselves, says that the winning document is trustworthy.
Once the context is assembled, the model receives several kinds of material together: the user’s request, application instructions, and the selected external content. The application may label and separate those materials, or it may present them as a less differentiated block. That formatting choice does not alter the document’s origin. It changes how visible the origin and intended role remain at the moment the model interprets the text.
Interpretation creates a second gate. The LLM may use a retrieved document as evidence, ignore instruction-like language inside it, or allow that language to change its answer. In a basic RAG application, the result may stop as generated text. In an agentic application, the result may be passed to a tool or another agent. At that point, the system has entered a new decision domain: whether a generated proposal is authorized to cause an external effect.