Engineer builds governed RAG pipeline to enforce strict LLM security controls

A developer built a controlled RAG system named ControlPlane to implement enterprise-grade security for LLMs. The system uses a governed pipeline where all model calls are routed through a single gateway and logged, with permissions enforced via YAML policies. Key security measures include scoping retrieval within Postgres using row-level security to prevent unauthorized data access. The project highlights that controls independent of model behavior, like database security, are more reliable than those relying on the LLM's compliance.