# Control 2.16: RAG Source Integrity Validation

**Control ID:** 2.16<br>
**Pillar:** Management<br>
**Regulatory Reference:** Fed SR 26-2 (formerly SR 11-7), OCC Bulletin 2026-13 (formerly OCC 2011-12), Interagency Third-Party Guidance (2023), FINRA 4511, FINRA RN 24-09, FINRA Rule 3110<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Establish governance over knowledge sources used for Retrieval-Augmented Generation (RAG) in Microsoft Copilot Studio agents to support accuracy, currency, approval status, and proper attribution of content used to ground agent responses.

---

## Why This Matters for FSI

- **Fed SR 26-2 (formerly SR 11-7):** Model validation requires assessment of data inputs including knowledge sources
- **Interagency Third-Party Guidance (2023):** Third-party risk management applies to external knowledge sources
- **OCC Bulletin 2026-13 (formerly OCC 2011-12):** Data quality controls for model inputs apply to RAG sources
- **FINRA 4511, FINRA RN 24-09 / Rule 3110:** Knowledge source approvals are books and records

---

## Control Description

This control establishes RAG governance through:

1. **Source Approval Workflow** - Formal approval before content becomes agent knowledge
2. **Content Versioning** - Track changes to knowledge sources over time
3. **Integrity Verification** - Validate source content hasn't been tampered with
4. **Citation Logging** - Track which sources agents use in responses
5. **Staleness Detection** - Identify outdated content requiring refresh
6. **Content Owner Accountability** - Assign owners responsible for source accuracy

### Built-In vs Custom Capabilities

| Capability | SharePoint/Copilot Studio | Implementation |
|------------|---------------------------|----------------|
| **Auto-sync from SharePoint** | Built-in | Native configuration |
| **Filter conditions (Modified on, Author)** | Built-in | Native configuration |
| **Permission-based access** | Built-in (live validation) | Native configuration |
| **Version history** | Built-in (SharePoint) | Native configuration |
| **Official source marking** | Built-in | Native configuration |
| **Approval workflows** | Power Automate | Custom configuration required |
| **Content checksums/hashing** | Not built-in | Custom implementation required |
| **Drift detection** | Not built-in | Custom implementation required |
| **Tamper verification** | Not built-in | Custom implementation required |
| **Citation accuracy validation** | Not built-in | Custom evaluation pipeline required |

!!! warning "Comprehensive Integrity Validation"
    SharePoint provides basic content governance features (versioning, permissions, filter conditions). However, comprehensive integrity validation including content checksums, drift detection, and tamper verification requires custom implementation using Power Automate, Azure Functions, or external integrity monitoring tools.

---

## Key Configuration Points

### Built-In Configuration (SharePoint/Copilot Studio)

- Define approved knowledge source types (SharePoint, OneDrive, Dataverse, Bing Custom Search, external)
- Configure content versioning on knowledge libraries (SharePoint built-in)
- Implement metadata schema: Owner, Approval Date, Review Date, Classification (SharePoint columns)
- Enable Copilot Studio citation tracking (built-in when using SharePoint sources)
- Configure filter conditions to control which content is indexed (SharePoint built-in)

!!! warning "Bing Custom Search Governance"
    Bing Custom Search, added as a Copilot Studio knowledge source type in March 2026, requires governance review before approval — organizations should evaluate whether internet-sourced content meets FSI data accuracy and provenance requirements.

### Custom Implementation Required

- Create SharePoint approval workflow for knowledge source additions (Power Automate configuration)
- Set staleness thresholds with automated alerting (90 days recommended, 30 days for regulatory content) - requires Power Automate flow
- Configure Power Automate alerts for expired content (custom flow)
- Implement content integrity checksums (custom solution - not built-in)
- Deploy drift detection monitoring (custom solution - not built-in)

!!! tip "Automation Available"
    See [RAG Source Validator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/rag-source-validator) in FSI-AgentGov-Solutions for automated SHA-256 hash validation, schema drift detection, and freshness monitoring across SharePoint, Dataverse, and Azure Blob sources.

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | User-managed sources; annual review; basic versioning | Personal use has limited grounding needs |
| **Zone 2** (Team) | Approved sources only; content owner assigned; quarterly review | Shared agents warrant source governance |
| **Zone 3** (Enterprise) | Formal approval workflow; mandatory versioning; staleness alerts; citation logging | Customer-facing requires maximum source integrity |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| AI Governance Lead | Define source approval criteria; oversee the integrity program; chair source-approval reviews |
| AI Administrator | Approve and manage Copilot Studio knowledge source connections and citation settings; maintain Copilot connector delegation |
| Content Owner | Maintain source accuracy; execute periodic review; respond to staleness alerts |
| SharePoint Admin | Configure libraries; implement versioning, content approval, and metadata schemas |
| Power Platform Admin | Govern Power Automate approval flows that gate knowledge source additions |
| Compliance Officer | Review regulatory content sources; validate retention alignment with SEC 17a-4 / FINRA 4511 |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [4.1 - SharePoint IAG](../pillar-4-sharepoint/4.1-sharepoint-information-access-governance-iag-restricted-content-discovery.md) | SharePoint-specific knowledge governance |
| [2.6 - Model Risk Management](2.6-model-risk-management-sr-26-2.md) | Source validation is MRM component |
| [3.10 - Hallucination Feedback](../pillar-3-reporting/3.10-hallucination-feedback-loop.md) | Source issues identified through feedback |
| [1.3 - SharePoint Content Governance](../pillar-1-security/1.3-sharepoint-content-governance-and-permissions.md) | Permissions control source access |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/2.16/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/2.16/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/2.16/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/2.16/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

### Built-In Capabilities

1. Content versioning enabled on all knowledge libraries (SharePoint setting)
2. Metadata schema applied with Owner and Review Date fields (SharePoint columns)
3. Citation logging captures source references in agent responses (Copilot Studio feature)
4. Filter conditions configured to control indexed content (SharePoint built-in)

### Custom Implementations (if deployed)

5. Knowledge source approval workflow functions correctly (Power Automate flow)
6. Staleness alert triggers for content past threshold (Power Automate flow)
7. Content integrity checksums validate source authenticity (custom implementation)

!!! note "Verification Scope"
    Items 5-7 require custom implementation. Verify these only if your organization has deployed custom workflows for RAG governance.

---

## Additional Resources

- [Microsoft Learn: Copilot Studio Knowledge Sources](https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-studio)
- [Microsoft Learn: SharePoint Versioning](https://learn.microsoft.com/en-us/sharepoint/governance/versioning-content-approval-and-check-out-planning)
- [Microsoft Learn: Power Automate Approvals](https://learn.microsoft.com/en-us/power-automate/get-started-approvals)
- [Microsoft Learn: Microsoft Purview DSPM for AI](https://learn.microsoft.com/en-us/purview/dspm-for-ai)
- [Microsoft Learn: Copilot Studio Citations](https://learn.microsoft.com/en-us/microsoft-copilot-studio/nlu-boost-node)
- [Federal Reserve SR 26-2 (formerly SR 11-7): Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm)
- [OCC Bulletin 2026-13: Model Risk Management (formerly OCC Bulletin 2011-12)](https://www.occ.gov/news-issuances/bulletins/2011/bulletin-2011-12.html)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
