Translate lab documentation to English
Some checks failed
Repo Quality / structure (push) Has been cancelled
Terraform Validate / validate (push) Has been cancelled

This commit is contained in:
Rodrigo Pace
2026-05-08 14:50:52 -03:00
parent cde150b705
commit 52bf971b8b
33 changed files with 939 additions and 702 deletions

View File

@@ -1,30 +1,30 @@
# Runbook - 06 RAG Vector Classified Docs
## Objetivo
## Objective
Demonstrar que um agente RAG so recupera chunks/documentos autorizados antes de enviar contexto ao LLM.
Show that a RAG agent retrieves only authorized chunks/documents before sending context to the LLM.
## Valor De Seguranca
## Security Value
- Reduz over-retrieval em RAG.
- Evita que chunks confidenciais sejam enviados ao modelo.
- Combina vector search com data grants por classificacao.
- Reduces over-retrieval in RAG.
- Prevents confidential chunks from being sent to the model.
- Combines vector search with data grants by classification.
## Pre-Requisitos
## Prerequisites
- Banco Oracle AI Database com suporte a `VECTOR`, `TO_VECTOR` e `VECTOR_DISTANCE`.
- Banco compativel com Oracle Deep Data Security.
- SQLcl ou SQL*Plus.
- Oracle AI Database with support for `VECTOR`, `TO_VECTOR`, and `VECTOR_DISTANCE`.
- Database compatible with Oracle Deep Data Security.
- SQLcl or SQL*Plus.
## Antes - Ambiente Vulneravel
## Before - Vulnerable Environment
1. Limpe o cenario:
1. Reset the scenario:
```sql
@scenarios/06-rag-vector-classified-docs/sql/99_reset.sql
```
2. Crie chunks e personas, sem aplicar data grants:
2. Create chunks and personas without applying data grants:
```sql
@scenarios/06-rag-vector-classified-docs/sql/00_schema.sql
@@ -32,52 +32,52 @@ Demonstrar que um agente RAG so recupera chunks/documentos autorizados antes de
@scenarios/06-rag-vector-classified-docs/sql/02_identities.sql
```
3. Simule a pergunta RAG:
3. Simulate the RAG question:
```text
Resuma documentos criticos sobre renovacoes, pessoas e riscos legais.
Summarize critical documents about renewals, people, and legal risks.
```
4. Execute a busca vetorial:
4. Run the vector search:
```sql
@scenarios/06-rag-vector-classified-docs/sql/04_test_queries.sql
```
## Resultado Esperado Antes
## Expected Result Before
- A busca pode recuperar chunks `HR_CONFIDENTIAL`, `LEGAL_CONFIDENTIAL` e `EXECUTIVE_CONFIDENTIAL`.
- O LLM poderia receber contexto sensivel antes mesmo de gerar a resposta.
- The search may retrieve `HR_CONFIDENTIAL`, `LEGAL_CONFIDENTIAL`, and `EXECUTIVE_CONFIDENTIAL` chunks.
- The LLM could receive sensitive context before it even generates an answer.
## Depois - Aplicando Deep Data Security
## After - Applying Deep Data Security
1. Aplique data grants por classificacao:
1. Apply data grants by classification:
```sql
@scenarios/06-rag-vector-classified-docs/sql/03_data_grants.sql
```
2. Execute a mesma busca como `nina`, `heitor`, `sofia` e `carlos`:
2. Run the same search as `nina`, `heitor`, `sofia`, and `carlos`:
```sql
@scenarios/06-rag-vector-classified-docs/sql/04_test_queries.sql
```
## Resultado Esperado Depois
## Expected Result After
- `nina` recupera apenas `PUBLIC` e `INTERNAL`.
- `heitor` recupera conteudo de RH autorizado.
- `sofia` recupera conteudo juridico autorizado.
- `carlos` recupera todos os chunks por papel executivo.
- A camada RAG so envia contexto autorizado ao LLM.
- `nina` retrieves only `PUBLIC` and `INTERNAL` chunks.
- `heitor` retrieves authorized HR content.
- `sofia` retrieves authorized legal content.
- `carlos` retrieves all chunks through the executive role.
- The RAG layer sends only authorized context to the LLM.
## Evidencias Para Demo
## Demo Evidence
- Lista de chunks recuperados antes/depois.
- Classificacoes visiveis por persona.
- Explicacao de que o controle ocorre antes da chamada ao LLM.
- Retrieved chunk list before and after protection.
- Visible classifications by persona.
- Explanation that enforcement happens before the LLM call.
## Referencias Oficiais
## Official References
- Oracle Deep Data Security Guide: https://docs.oracle.com/en/database/oracle/oracle-database/26/ddscg/index.html
- Create Data Grants: https://docs.oracle.com/en/database/oracle/oracle-database/26/ddscg/create-data-grants.html