Data Boundaries for Agents: RAG vs Fine-Tune vs Context Windows, a DLP View

Your DLP program assumes data lives somewhere you can point to and moves through channels you can watch. The three ways an agent reaches proprietary data break that assumption differently, and only one is a one-way door. You can pull a document from a RAG index before lunch. End a session and whatever sat in the context window is gone. You cannot un-train a weight. That asymmetry decides where each control has to sit, and a team that ships one control set for all three will over-block in one place and leave a gap in another that a pentest finds first.

The provider side is the easy half. Azure OpenAI does not use customer prompts, completions, or fine-tuning data to train its foundation models, per Microsoft, and Anthropic's enterprise and API traffic is governed by the commercial customer agreement rather than the consumer privacy policy, per Anthropic. The three internal data paths are the part you own. NIST's AI RMF (AI 100-1, January 2023) calls the honest inventory of where your data goes the Map function, per NIST. This is that map.

The three data paths

Pattern	Data lives	Access timing	Revocable?	Default audit trail
RAG	Vector index / search	Runtime retrieval	Yes (remove from index)	Retrieval logs (if enabled)
Fine-tuning	Model weights	Baked in at train time	No	Training-data manifest (one-time)
Context window	In-session only	Inference time	Yes (end session)	Inference logs (if enabled)

RAG puts a copy of your source data in a vector index and the model touches it at query time through a retriever. Revoke access by dropping the entry or re-running the ACL filter, and you have a retrieval log if you turned one on. The catch is the copy itself: the index sits outside the source system, so its permission model does not exist until you rebuild it at the retriever.

Fine-tuning absorbs the data into the weights during training. There is no row to delete and no session to close. Access is not scoped at inference; it is latent in any response the model can produce. Your only audit artifact is the training-data manifest you captured before the run, and if you did not capture it, you cannot say what the model learned.

A context window holds the data for the length of one inference and drops it when the session ends, assuming nothing logs the transcript to longer retention. This is the tightest and most transient of the three. The exposure is different in kind: whatever shares the window shares a trust boundary with the model's instructions.

The three threat surfaces

RAG, retrieval overfetch. The retriever pulls more chunks than the query needs, and the model surfaces a document the requester could never open in the source system. It fails when the embedding index carries no document-level ACL, so a user's query returns matches from files they hold no rights to. OWASP files this under Vector and Embedding Weaknesses (LLM08:2025) and the leak itself under Sensitive Information Disclosure (LLM02:2025), per the OWASP GenAI Security Project. The control: enforce ACL filters at retrieval time, keyed to the requesting user, not only at the source API. The index is a second copy and needs its own access policy.

Fine-tuning, training-data extraction. A probed model can be walked into repeating memorized training text. Carlini et al. (2021) extracted hundreds of verbatim sequences from GPT-2, including names, phone numbers, and email addresses, per their paper; Nasr, Carlini et al. (2023) scaled the same attack to production models, per their follow-up. The blast radius is worst on models tuned over contracts, internal memos, or PII-bearing support transcripts. The control is upstream and one-time: classify and scrub the training set for PII before the run, then classify the resulting weights at the same level as the data that made them. There is no post-hoc delete.

Context windows, prompt injection. An agent reads an uploaded PDF, an email body, or a fetched web page into the window beside its tool-calling instructions, and adversarial text redirects what it does next. OWASP classifies this as Prompt Injection (LLM01:2025), per the OWASP GenAI Security Project. It fails in document pipelines that treat an authenticated upload as trusted because the file came through a login. The control: keep untrusted content out of the system-prompt trust zone, and validate output before any tool call that changes state. Our prompt-injection defense guide covers the deputy problem in full.

Which controls transfer, and which do not

Four controls, and not one of them covers all three patterns. The matrix is the placement map; the prose is the reason it looks the way it does.

Output scanning is the only control that touches all three patterns, and it is the last line, not the plan. Source and retrieval ACLs cover RAG and context windows and do nothing for fine-tuning, since once data is in the weights there is no source left to gate. Retention and delete work the same way: drop a RAG index entry, expire a session log, but there is no delete path for a weight short of retraining. The take-home a security team keeps missing: a strong RAG control set does not extend to the fine-tuned model sitting next to it. The MCP governance guide covers the tool-server layer where these same access decisions get made at call time.

The least-privilege default

For most enterprise agents reaching confidential data, RAG with index-level ACLs is the lowest-risk default. Not because retrieval is inherently safe, but because access is scoped at query time, revocable by editing the index, and logged. Fine-tune only when the use case needs learned style or behavior you cannot fetch at inference; factual recall does not qualify, and a data-classification review belongs in front of the training run precisely because you cannot walk it back. Context windows fit short-lived, task-scoped reads from a trusted source with the session logged. Do not pour untrusted, user-supplied content into a multi-turn agent's window and call it access control. For the runtime that wraps all three, the agent sandboxing patterns and agent skill security review are the companion layers.

The checklist

Assign each line to an owner. Not a framework, not a 40-point audit.

• RAG: the index enforces ACL filters that mirror source-system permissions at retrieval time, refreshed against the source, not a point-in-time snapshot.
• Fine-tuning: datasets are reviewed for PII and confidential content before training, and the resulting weights are classified at the same level as the training data.
• Context windows: pipelines separate untrusted document content from system-prompt context, and output is validated before any state-modifying tool call.