AI search security: keep retrieved content in the role of evidence
Map trust boundaries, limit tool authority, protect credentials, and evaluate how the full application handles outside content.
Read the guideBuild evidence packets, select relevant passages, validate citations, and test what happens when the sources cannot answer.

Connecting a search engine to a large language model is not just a matter of placing search results into a prompt. A dependable application needs to decide which information is relevant, preserve its origin, restrict what the model may infer, and verify that the resulting answer is supported by the evidence it was given.
This guide proposes a small evidence pipeline for a research assistant. It focuses on the boundary between search results and generated claims. The examples describe an application design, not a live service offered by this website. You can inspect the same ideas in the local JSON examples without supplying credentials or sending a query to an external system.
The original Retrieval-Augmented Generation research paper studies models that combine learned parameters with retrieved nonparametric memory. Its contribution helps explain why external evidence can be useful for knowledge-intensive tasks. It does not establish that every application with a search call is accurate, current, or correctly cited.
For your own system, treat retrieval as a way to provide inspectable context rather than as a guarantee of truth. A retrieved document can be irrelevant, stale, contradictory, or misleading. The engineering task is to expose and manage those conditions. A fluent answer should not be allowed to conceal an evidence selection process that the application cannot explain.
Before retrieving, identify what the user is asking and which sources are appropriate. A question about a software feature may require official documentation for a specific version. A historical question may require a different source set and a different freshness policy. Preserve the scope in the task record so that later stages do not silently broaden it.
Where the query is ambiguous, resolve the ambiguity through a clear product interaction or return alternatives. Do not guess a product version and present its specification as universal. For a bounded pilot, use a small collection of questions with explicit source expectations. This gives reviewers a meaningful reference when deciding whether the retrieval stage selected appropriate evidence.
A search result is often a pointer to a source rather than the full evidence needed to answer a detailed question. Where access and reuse are permitted, retrieve the relevant material and select passages that directly address the task. Preserve the destination URL, document title, source identifier, and the selected passage together.
An evidence packet might contain a task identifier, retrieval timestamp, source records, and a list of allowed claims or unresolved questions. Keep the passage text separate from application instructions. The response schema documentation includes a small illustrative packet with source identifiers and a synthetic context string. It is intended to make the data boundary understandable, not to prescribe a provider-specific endpoint.
More retrieved text can create more opportunities for distraction, duplication, and contradiction. Choose a passage budget that reflects the task and the model’s actual constraints. Preserve enough surrounding context to avoid changing the meaning of a sentence, but avoid adding an entire document when a short section provides the necessary evidence.
Use a reviewable selection rule. For a compatibility question, the rule might prioritize the exact product and version, then the relevant feature section. For a comparison, it might require one appropriate source for each item. Record why a passage was selected where the application needs an audit trail. This makes retrieval improvements more concrete than simply increasing the number of search results.
Retrieved text is evidence supplied by an external source, not a new authority over the application. It should not be able to redefine the user’s task, change tool permissions, or instruct the system to disclose secrets. Delimit the evidence clearly and keep application instructions in a separate channel or structured field supported by your implementation.
Do not assume formatting alone solves the problem. Restrict the tools available during answer generation, avoid including unnecessary secrets in context, and require explicit approval for consequential actions. A research assistant that only needs to produce a cited explanation should not also receive unrestricted authority to execute commands or send messages. The AI search security guide develops that separation further.
Ask the answer stage to stay within the supplied evidence, identify uncertainty, and associate substantive claims with source identifiers. Keep the output structure simple enough to validate. For example, a response can separate the answer, supporting source references, and unresolved limitations rather than mixing all three into an unstructured paragraph.
After generation, check that every referenced identifier exists in the evidence packet. Inspect whether the cited passage supports the claim, not merely whether the citation is well formed. A citation can point to a real document and still fail to support the sentence beside it. For high-impact use cases, use an appropriate human review process rather than treating automated validation as sufficient.
Include questions that the source collection cannot answer. The expected behavior should be a clearly bounded response explaining what is missing, not a confident completion based on familiar patterns. Also include documents that disagree or describe different versions. The answer should preserve the disagreement or distinguish the versions rather than merging them into a single invented specification.
For a hypothetical device assistant, one manual might describe an earlier hardware revision and another a later revision. A good response identifies which revision each statement applies to. If the user’s device revision is unknown, that becomes the limitation. This test checks whether the system respects source scope instead of selecting whichever passage makes the answer sound most complete.
Create an evaluation set with known relevant sources, expected answer elements, unacceptable claims, and permitted uncertainty statements. Review retrieval quality separately from answer faithfulness. A system can retrieve the correct source and still misstate it, or generate a careful answer from an incomplete source set. Those failures require different corrections.
Track test results by task type and system version. Keep examples of failures so that a later improvement does not reintroduce a previously corrected problem. Treat any aggregate score as a description of that specific evaluation set, not as a universal accuracy claim. Read a sample of individual outputs even when a summary metric looks encouraging.
The user-facing interface should make it easy to inspect the supporting material. Show readable source titles, distinguish retrieval time from publication time, and keep citations near the claims they support. Avoid presenting a generated answer as a direct quote unless it is actually a faithful quotation with appropriate handling.
For exports, retain stable source identifiers and the evidence version used. A saved answer without its supporting context becomes harder to verify later, especially when source pages change. Define retention according to the relevant permissions and the task’s needs. Preserve only what is necessary, and make clear when a later reader may need to recheck the original source.
A search-connected LLM becomes more useful when the surrounding workflow makes its evidence visible and its limitations inspectable. Define the task, choose an appropriate source scope, select relevant passages, separate evidence from instructions, and verify the relationship between claims and citations.
Start with a bounded pilot and evaluate difficult cases before expanding the collection or adding more autonomous actions. The objective is not an answer that always sounds complete. It is an answer process that another person can inspect, challenge, and correct. Explore the AI search engine guide for the broader product design and the local examples for a concrete starting point.
Explore this guide’s topics
KEEP THE IDEAS COMING

Map trust boundaries, limit tool authority, protect credentials, and evaluate how the full application handles outside content.
Read the guide
Separate discovery, retrieval, and generation. Design an AI search experience that makes its evidence and limitations visible.
Read the guide
Use transparent workload arithmetic, explicit billing assumptions, and usable-observation costs to plan a bounded pilot.
Read the guide