A practical overview of security architectures, threat models, and controls for protecting proprietary enterprise data in retrieval-augmented generation (RAG) systems.