enterprise-rag-patterns

Unreleased authorization hardening: see migration and verification notes.

Reference patterns for FERPA/HIPAA/GDPR-compliant retrieval-augmented workflows — 50 regulated sector examples, 65+ regulations across 25 jurisdictions, 9 AI frameworks, 5 vector store adapters, 1,901 tests.

Defense-in-depth pre-filters that enforce regulatory requirements at the retrieval layer, before any document reaches the LLM context window.

The problem this solves

Standard RAG implementations retrieve documents and pass them directly to an LLM — with no enforcement of who is allowed to see what. In regulated environments this creates a structural compliance failure: a student receives another student's financial aid record; a patient's ePHI surfaces in an unrelated clinical query; a grid operator's chatbot leaks BES Cyber System documentation to an unauthorized contractor.

This library provides the missing compliance layer: identity-scoped pre-filters, layered regulatory enforcement, and structured audit records. Documents that fail any compliance layer never reach the LLM.

Architecture: Defense-in-Depth

User Query
    │
    ▼
┌─────────────────────────────────────────────────┐
│         Vector Store Retrieval (candidate docs)  │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────┐
│  LAYER 1 — Identity / Access Gate               │
│  Who is the user? What are their clearances?    │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────┐
│  LAYER 2 — Regulatory Domain Gate               │
│  Does this document belong to this regulation?  │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────┐
│  LAYER 3 — Contextual Policy Gate               │
│  Is this access appropriate in this context?    │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────┐
│  LAYER 4 — Sector-Specific Gate                 │
│  Are there additional domain requirements?      │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────┐
│  Audit Record (written before LLM sees docs)    │
│  user_id · document_id · regulation_citation    │
│  layers_passed · layers_denied · timestamp      │
└────────────────────┬────────────────────────────┘
                     │
                     ▼
                 LLM Context

Why pre-filter, not post-filter? Post-filtering is a UI concern — the LLM has already processed the unauthorized record. FERPA, HIPAA, and NERC CIP require that disclosure not occur, not that unauthorized data be hidden after the fact. See docs/adr/001-pre-filter-not-post-filter.md.

Installation

pip install enterprise-rag-patterns

With vector store or framework extras:

pip install 'enterprise-rag-patterns[langchain]'
pip install 'enterprise-rag-patterns[haystack]'
pip install 'enterprise-rag-patterns[llama-index]'
pip install 'enterprise-rag-patterns[dspy]'
pip install 'enterprise-rag-patterns[pinecone]'
pip install 'enterprise-rag-patterns[weaviate]'
pip install 'enterprise-rag-patterns[qdrant]'
pip install 'enterprise-rag-patterns[chromadb]'

Quick start

from enterprise_rag_patterns.compliance import (
    StudentIdentityScope, RecordCategory,
    FERPAContextPolicy, DisclosureReason,
)

scope = StudentIdentityScope(
    student_id="stu_001",
    institution_id="univ_abc",
    requesting_user_id="advisor_007",
    authorized_categories={RecordCategory.ACADEMIC_RECORD},
    disclosure_reason=DisclosureReason.SCHOOL_OFFICIAL,
)
policy = FERPAContextPolicy(scope=scope)

# Filter before the LLM sees any document
safe_docs = policy.filter_retrieved_documents(
    retrieved_docs,
    student_id_field="student_id",
    institution_id_field="institution_id",
    category_field="category",
)

# Emit a 34 CFR §99.32 disclosure log entry
audit = policy.record_access(categories_accessed={RecordCategory.ACADEMIC_RECORD})

See the examples/ directory for complete runnable pipelines.

Example catalog — 50 patterns

Agentic & Runtime Security (2025–2026 Standards)

| 49 | 49_owasp_llm_rag_security.py | Agentic / RAG Security | OWASP LLM Top 10 2025 — LLM01PromptInjectionFilter (direct + indirect injection pattern matching + instruction override detection), LLM08EmbeddingWeaknessFilter (poisoned vector payload + tampered embedding source blocking), LLM06SensitiveDisclosureFilter (PII + credentials + classification markers DLP before retrieval context), RAGOutputValidationFilter (structured output integrity + hallucination marker + citation format validation before delivery) | | 50 | 50_rag_security_auditor.py | Enterprise Security Audit | Holistic RAG security gap-analysis framework — RAGSystemConfig (27-field configuration snapshot), RAGSecurityAuditor (22 controls across 6 domains: Input Validation, Vector Store Security, Retrieval Controls, Output Security, Action Gating, Observability), RAGAuditReport (scored 0–100, CSA ATF maturity: Sandbox/Controlled/Trusted/Autonomous), framework refs: OWASP LLM/ASI, NIST AI 600-1, ISO 42001, MITRE ATLAS v5.1, CSA ATF, SOC 2, HIPAA, GDPR, FERPA |

Regulation coverage matrix

How this compares to alternatives

No other open-source library enforces regulatory compliance at the pre-retrieval layer across this breadth of frameworks and regulations:

Key architectural distinction: Standard RAG architectures apply compliance logic after the LLM processes documents. Under FERPA's disclosure rule (34 CFR § 99.30) and HIPAA's Minimum Necessary Rule (45 CFR § 164.502(b)), a document in the LLM context window constitutes a disclosure — regardless of whether the output is filtered afterward. This library enforces access control before retrieval, at the vector store query level.

Framework and vector store integrations

Repository structure

src/enterprise_rag_patterns/
├── compliance.py               # FERPA identity scoping + 34 CFR §99.32 audit
├── context.py                  # Multi-source ContextEnvelope assembly
├── session.py                  # Cross-channel session continuity
├── policy.py                   # Escalation + action-boundary policy objects
├── async_compliance.py         # Async wrappers (asyncio / FastAPI)
├── regulations/
│   ├── gdpr.py                 # GDPR Article 17 right-to-erasure
│   ├── hipaa.py                # HIPAA ePHI minimum-necessary + audit
│   ├── iso27001.py             # ISO/IEC 27001:2022 ISMS CBAC
│   ├── nist_ai_rmf.py          # NIST AI RMF 1.0 + AI 600-1
│   ├── owasp_llm.py            # OWASP LLM Top 10 (2025) LLM01/LLM02
│   ├── pci_dss.py              # PCI DSS v4.0 CHD/PAN masking
│   └── soc2.py                 # SOC 2 Type II CC6.1/CC6.6/C1.1
├── vector_stores/
│   ├── pinecone_adapter.py
│   ├── weaviate_adapter.py
│   ├── qdrant_adapter.py
│   └── chroma_adapter.py
└── integrations/
    ├── langchain.py
    ├── langchain_lcel.py
    ├── llama_index.py
    ├── haystack.py
    └── maf.py
examples/                       # 30 runnable sector examples (see catalog above)
tests/                          # 924 passing tests (2 skipped)
docs/
├── architecture.md
├── adr/                        # Architecture Decision Records
│   ├── 001-pre-filter-not-post-filter.md
│   └── 002-two-layer-enforcement.md
└── implementation-note-*.md

Published notes and articles

• Implementation Note 01 — Cross-channel continuity and compliance scope
• Implementation Note 02 — FERPA boundaries in retrieval-augmented generation
• ADR 001 — Why pre-filter, not post-filter
• ADR 002 — Two-layer enforcement: vector store + policy

Near-term roadmap

• Async vector store adapters for FastAPI/asyncio
• ferpa-haystack Haystack Hub listing (pending deepset review)
• LlamaIndex workflow integration for FERPA + HIPAA multi-regulation pipelines
• Google ADK retrieval guard (pre-retrieval enforcement for ADK agents)

Contributing

Read CONTRIBUTING.md and GOVERNANCE.md. Run pytest tests/ -v before opening a pull request.

Citation

@software{rana2026erp,
  author  = {Rana, Ashutosh},
  title   = {enterprise-rag-patterns: Cross-industry compliance patterns for RAG pipelines},
  year    = {2026},
  version = {0.46.0},
  url     = {https://github.com/ashutoshrana/enterprise-rag-patterns},
  license = {MIT}
}

Part of the enterprise AI patterns trilogy

License

MIT — see LICENSE.