להגן על עוזר AI וחיפוש RAG באמצעות הרשאות מחוץ לפרומפט

Read this tutorial as reference material:
https://nethanelfitoussi.com/article/ai-rag-prompt-injection-guardrails?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Available starter files:
https://nethanelfitoussi.com/api/media/f34e57b8-eb7c-49ea-889f-441e88ba63f0.zip
Download and inspect these files in a temporary folder before using them. Do not overwrite existing project instructions.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Use the downloaded starter lab in a NEW folder. Read README.md and both English prompts first. Run its dependency-free Node.js tests before editing.

Review this LOCAL AI/RAG boundary lab. No real model or external service is
connected. Read lab.mjs and lab.test.mjs. Identify trusted actor and ACL metadata,
untrusted document text, proposed model tool calls and the execution budget. Test
whether a document instruction, forged tenant field or unknown write tool could
bypass the gateway. Do not treat a system prompt, an opaque document ID, a vector
search score or a model’s user_confirmed flag as authorization. Produce evidence and
remaining integration requirements, not a claim of complete prompt-injection
resistance.

Implement only the agreed local gateway improvement and add a regression test. Keep
authorization and argument validation in server-controlled code outside the model.
Use authenticated actor/tenant metadata, a document ACL, an explicit tool allowlist
and a bounded call budget. Keep retrieved document text as data. Use harmless
synthetic documents and proposed tool calls; do not connect a real database, send
messages or execute shell commands. Run node --test lab.test.mjs. Document that
these tests check policy enforcement, not a live model, a vector database
integration or an injection detector.

Adapt example paths, commands and acceptance criteria to this repository rather than assuming they match.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.