For a RAG system, the most useful MITRE ATLAS mitigations are Generative AI Guardrails, AI Telemetry Logging, Maintain AI Dataset Provenance, access control on models and data, Input and Output Validation done outside the agent, and limits on tool use after untrusted data enters context. This checklist turns each into a question you can answer.
Content controls
Generative AI Guardrails (AML.M0020). ATLAS describes guardrails as controls between users, tools and models that evaluate prompts, retrieved context, outputs and agent actions. Check: do your guardrails see retrieved text, or only the user's prompt? Many setups filter the prompt and trust everything the retriever returns.
Generative AI Guidelines (AML.M0021). System prompts and templates that set role, allowed behaviour and citation expectations. Check: is there a written rule about what to do when retrieved text contains instructions? Note that guidelines steer the model but are not a security boundary on their own.
Input and Output Validation for AI Agent Components (AML.M0033). Schema checks, leakage checks and sanitisation on tool and data source inputs and outputs. ATLAS says validation should be performed external to the AI agent. Check: is the validator code, or is it another prompt?
Data controls
Maintain AI Dataset Provenance (AML.M0025). Keep a history of the source of each dataset and every modification. For RAG, read "dataset" as "document collection". Check: for any chunk in the index, can you say where it came from and when it was added?
Control Access to AI Models and Data at Rest (AML.M0005) and in Production (AML.M0019). Limit internal access to models and training data, and require authentication on production endpoints while monitoring queries. Check: who can write to the vector store, and is that list shorter than who can read it?
Limit Public Release of Information (AML.M0000). Public detail about your AI stack helps attackers target it. Check: do blog posts, job ads or docs say which sources your assistant indexes?
Runtime controls
AI Telemetry Logging (AML.M0024). Log inputs and outputs of deployed models, and for agents the intermediate steps, data access, tool use and agent identity. Check: after an incident, could you list which documents were retrieved for a given answer?
Restrict AI Agent Tool Invocation on Untrusted Data (AML.M0030). Once untrusted data enters context, limit automatic tool calls or ask for confirmation, more strictly for high consequence actions. Check: can a retrieved document trigger a tool call without a person seeing it?
Human In-the-Loop for AI Agent Actions (AML.M0029). Approval should scale with consequence. Check: which actions are approved by a person today, and which should be?
Memory Hardening (AML.M0031). If the assistant keeps persistent memory, control how it is written, scoped, audited and recovered.
Testing controls
AI Red Team (AML.M0035). Recurring, authorised, threat-informed exercises that cover the whole system, retrieval included. See how to scope an AI red team exercise.
Validate AI Model (AML.M0008). Test for backdoor triggers, data leakage and adversarial influence, and watch for drift that may indicate tampering.
Scoring yourself
Mark each item done, partial or missing. Do not aim for all done. Aim for no missing item on a technique your threat model marks as plausible. The mapping guide shows how to decide which those are.
Quick check
Which single item matters most for RAG?
There is no single answer, but controls on who can write to the index come first. Most RAG attacks need a way to get content in.
Do these mitigations come with test procedures?
ATLAS describes what each mitigation is and which techniques it addresses. You still need to write your own tests.
Sources
- MITRE ATLAS data repository (mitre-atlas/atlas-data), 2026.09 release data.
Last reviewed: 19 October 2026.
