rodrigo.pace/oracle-deep-data-security-lab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve RAG vector classified docs scenario
Some checks failed
Repo Quality / structure (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Rodrigo
2026-05-14 11:49:13 -03:00
parent 4ab75ed578
commit 5fa6b34d1e
7 changed files with 165 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
scenarios/06-rag-vector-classified-docs/sql/00_schema.sql
View File

@@ -1,11 +1,20 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
CREATE TABLE dds_rag_chunks (
chunk_id NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
document_title VARCHAR2(160) NOT NULL,
department VARCHAR2(40) NOT NULL,
classification VARCHAR2(30) NOT NULL,
chunk_text VARCHAR2(1000) NOT NULL,
embedding VECTOR(3, FLOAT32)
);
BEGIN
EXECUTE IMMEDIATE q'[
CREATE TABLE dds_rag_chunks (
chunk_id NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
document_title VARCHAR2(160) NOT NULL,
department VARCHAR2(40) NOT NULL,
classification VARCHAR2(30) NOT NULL,
chunk_text VARCHAR2(1000) NOT NULL,
embedding VECTOR(3, FLOAT32)
)
]';
EXCEPTION
WHEN OTHERS THEN
IF SQLCODE != -955 THEN
RAISE;
END IF;
END;
/

25
scenarios/06-rag-vector-classified-docs/sql/01_seed_data.sql
View File

@@ -1,19 +1,22 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET DEFINE OFF
INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
VALUES ('Benefits Policy', 'HR', 'INTERNAL', 'General benefits policy available to employees.', TO_VECTOR('[0.10,0.20,0.30]'));
DELETE FROM dds_rag_chunks;
INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
VALUES ('Executive Compensation Plan', 'HR', 'HR_CONFIDENTIAL', 'Compensation calibration for executives and retention risks.', TO_VECTOR('[0.11,0.21,0.31]'));
INSERT INTO dds_rag_chunks (chunk_id, document_title, department, classification, chunk_text, embedding)
VALUES (1, 'Benefits Policy', 'HR', 'INTERNAL', 'General benefits policy available to employees.', TO_VECTOR('[0.10,0.20,0.30]'));
INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
VALUES ('Contract Renewal Risk', 'LEGAL', 'LEGAL_CONFIDENTIAL', 'Legal risk on renewal clauses for strategic accounts.', TO_VECTOR('[0.80,0.10,0.20]'));
INSERT INTO dds_rag_chunks (chunk_id, document_title, department, classification, chunk_text, embedding)
VALUES (2, 'Executive Compensation Plan', 'HR', 'HR_CONFIDENTIAL', 'Compensation calibration for executives and retention risks.', TO_VECTOR('[0.11,0.21,0.31]'));
INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
VALUES ('Company Travel Guide', 'GENERAL', 'PUBLIC', 'Public travel and expense guidance for all employees.', TO_VECTOR('[0.20,0.70,0.10]'));
INSERT INTO dds_rag_chunks (chunk_id, document_title, department, classification, chunk_text, embedding)
VALUES (3, 'Contract Renewal Risk', 'LEGAL', 'LEGAL_CONFIDENTIAL', 'Legal risk on renewal clauses for strategic accounts.', TO_VECTOR('[0.80,0.10,0.20]'));
INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
VALUES ('Board M&A Briefing', 'EXEC', 'EXECUTIVE_CONFIDENTIAL', 'Potential acquisition targets and board-level financial exposure.', TO_VECTOR('[0.90,0.20,0.40]'));
INSERT INTO dds_rag_chunks (chunk_id, document_title, department, classification, chunk_text, embedding)
VALUES (4, 'Company Travel Guide', 'GENERAL', 'PUBLIC', 'Public travel and expense guidance for all employees.', TO_VECTOR('[0.20,0.70,0.10]'));
INSERT INTO dds_rag_chunks (chunk_id, document_title, department, classification, chunk_text, embedding)
VALUES (5, 'Board M&A Briefing', 'EXEC', 'EXECUTIVE_CONFIDENTIAL', 'Potential acquisition targets and board-level financial exposure.', TO_VECTOR('[0.90,0.20,0.40]'));
COMMIT;
SET DEFINE ON

9
scenarios/06-rag-vector-classified-docs/sql/02_identities.sql
View File

@@ -17,6 +17,15 @@ GRANT rag_session_role TO rag_hr_role;
GRANT rag_session_role TO rag_legal_role;
GRANT rag_session_role TO rag_exec_role;
-- Vulnerable baseline: this broad role simulates a RAG retrieval layer that can
-- query every chunk before DDS is enforced.
CREATE ROLE rag_legacy_retrieval_role;
GRANT SELECT ON dds_rag_chunks TO rag_legacy_retrieval_role;
GRANT rag_legacy_retrieval_role TO rag_employee_role;
GRANT rag_legacy_retrieval_role TO rag_hr_role;
GRANT rag_legacy_retrieval_role TO rag_legal_role;
GRANT rag_legacy_retrieval_role TO rag_exec_role;
GRANT DATA ROLE rag_employee_role TO nina;
GRANT DATA ROLE rag_hr_role TO heitor;
GRANT DATA ROLE rag_legal_role TO sofia;

2
scenarios/06-rag-vector-classified-docs/sql/99_reset.sql
View File

@@ -20,6 +20,8 @@ BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE rag_exec_role'; EXCEPTION WHEN OTHERS TH
/
BEGIN EXECUTE IMMEDIATE 'DROP ROLE rag_session_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP ROLE rag_legacy_retrieval_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER nina'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER heitor'; EXCEPTION WHEN OTHERS THEN NULL; END;