Provenance, ACLs & Multi-Hop Research

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R09 — PostgreSQL

   R13 — Qdrant ACLs

   R04 — LLM Top 10

   R05 — MITRE ATLAS

   R14 — Ragas

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit chunk provenance, tenant/document ACLs, vector filters, deletion propagation, and D10 Sleeper-Agent Scrubber. Complete `C2` (Multi-hop research & citation provenance): decompose complex queries into sub-queries, retrieve authorized passages per hop, detect cross-document contradictions, and verify citations via D5.

   Complete `C5` (Multi-agent coordination & conflict resolution) inside P2: run a bounded 3-role review (Extraction/Research Agent + Evidence Reviewer + Policy/Security Reviewer) using typed envelopes (D3 contract) and deterministic conflict adjudication/human escalation. Run the full poisoning, multimodal OCR/audio, and D6 CFG output-caging attack corpus.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 81 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Cross-tenant ACL tests, C2 multi-hop contradiction/citation tests, C5 multi-agent conflict-resolution tests, and D5/D6/D10 attack corpus report.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R09PostgreSQL Documentation↗ postgresql.org

  Foreign-key constraints, indexes, ACID transactions, row-level security (RLS), and query planning.

• R13Qdrant Documentation↗ qdrant.tech

  Collections, payload metadata indexing, pre-filtering, multitenancy partitioning, and snapshots.

• R14Ragas Documentation↗ docs.ragas.io

  RAG evaluation metrics: context precision, context recall, faithfulness, and answer relevance.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsQdrant · docs
  Configure Multitenancy

  Shows payload-based tenant partitioning with is_tenant indexes and a mandatory must-filter on every query — the mechanism that keeps chunk retrieval inside one tenant's ACL boundary.

  R13moved 2026-11-11
• videoProfessor Py: AI Foundations
  Qdrant Payload Filtering in Python: Search Vectors with Metadata Conditions

  Builds a QdrantClient workflow that enforces ownership and recency filters during search, which is the vector-filter audit in runnable form rather than a policy claim.

  R13checked 2026-11-11
• videoSecureTechIn
  AI Security Lesson 15: RAG Poisoning Explained for Security Teams

  Walks the four-step poisoning chain and the PoisonedRAG result that a handful of injected texts per target question suffices, which sets the D10 scrubber's detection threshold and test corpus size.

  R04R05checked 2026-11-11
• articlearXiv (USENIX Security 2025) · paper
  Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents

  Shows query-specific blocker documents that make retrieval return useless context — the availability side of poisoned corpora, which the day measures.

  R04R05checked 2026-11-11
• docsOWASP · cheat sheet
  RAG Security - OWASP Cheat Sheet Series

  Covers per-chunk access-control inheritance, signed source attribution on responses, and index integrity monitoring, which are the provenance and deletion-propagation controls for C2 and D5.

  R04R09checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.