Defending the RAG pipeline uses pre-retrieval ACLs and post-generation gates. The three structural rules are permission-aware retrieval, a Content Security Policy (img-src 'self') and URL allowlist, and no autonomous write execution from untrusted context. The OWASP Top 10 for LLM Applications lists LLM01: Prompt Injection. OWASP guidance supports a key rule: model robustness alone cannot substitute for system-level access control. The NIST AI Risk Management Framework Generative AI Profile lists prompt injection as an information security risk. Treat the LLM as an untrusted parser whenever it ingests external text.