Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Authorization and Security in RAG: Document-Level Permissions, Multi-Tenant Filters and Indirect Prompt Injection
In RAG, authorization isn't a request in the prompt but the WHERE clause of the retrieval query: told "don't reveal this", gemma3:4b told a customer the staff discount. We take tenant and ACL from the token into the query with EF Core 10 named query filters, and measure an HNSW filter returning 1 result instead of 10 and a poisoned reader review asking for card numbers.
LLM Message Roles and the System Prompt: Giving the Bookstore Assistant an Identity
What are the system, user and assistant roles for, and how does Gemma 3's chat template carry them to the model? We write a system prompt for the Bookstore assistant, look at the parts of a good system prompt, and use real output to see how a forged assistant message from the client fools the model and how far separating user text from instructions helps as a first step against prompt injection.