RAG risk is retrieval risk
A retrieval-augmented generation system is only as reliable as what it retrieves. Source quality, stale information, incorrect retrieval and access-control failure can all produce a confident, well-written, wrong answer. Grounding and citation, so an answer can be traced back to its source, matter more here than in a general-purpose chatbot review.
An internal document assistant is a useful test case
An HR policy chatbot built on RAG across internal documents can retrieve an outdated policy version, surface a document a staff member should not see, or answer confidently from a source that was never authoritative. None of these are model problems in the traditional sense; they are retrieval pipeline and access control problems.
Agents introduce a different category of risk
An AI agent that can call tools, send communications or update records is not just generating text, it is taking action. That changes what needs controlling: agent permissions, tool permissions, sandboxing, human approval gates for consequential actions, rate limits and kill switches. Prompt injection, including indirect prompt injection hidden inside a retrieved document, becomes a security concern rather than a quality concern.
What good controls look like in practice
An agent that can send an email or update a customer record needs an approval gate before that action executes, a clear boundary on what it is permitted to do, and logging that supports a later audit trail. An incident communication plan, for when an agent takes an unintended action, is part of readiness, not an afterthought.
Match the control to what the system can actually do
The right question is not whether a system uses generative AI. It is what the system is actually able to retrieve, generate or act on, and what happens when that goes wrong. Controls should be sized to that answer, not to a generic AI risk template.
RAG and agentic AI security controls are covered in detail in the AI Governance, Risk & Compliance Practitioner programme.