Only approved sources reach knowledge and the model.
The threat
untrusted content durably contaminates the knowledge base (RAG), the model (poisoned model) or the supply chain (vulnerable dependency, malicious package, outdated detector), influencing every future answer.
Blind spotWhy classic frameworks miss it
the database here is knowledge that expresses itself in the answers; poisoning is slow, diffuse, and looks like neither SQL injection nor a network compromise.
MitigationProposed approach
only approved ingestion writes to the base (no caller speech re-injected as-is), SBOM, digests and signatures of model artifacts, CVE scanning, adversarial benchmarks.
The proposed control
no unapproved content enters the base; model artifacts verified by digest.
Expected evidence
trace that no unapproved content can enter the KB and that model artifacts are digest-verified.