A safe RAG architecture keeps untrusted content out of the prompt where it can do damage, enforces who can read what at the retriever, and limits what the model can do after retrieval.
Most RAG systems I have seen in real projects do the first half and skip the rest. They retrieve, they answer, they go through a security review that mostly stares at the LLM call. That ...