PulseFlow Tecnologia
← Insights
·6 min read·technical-guide·rag·mcp·shadow-ai
PulseFlow Tecnologia

How to use RAG, MCP, and external tools without creating Shadow AI

Shadow AI doesn't come from bad intentions - it comes from teams each solving, their own way, the same problem: how to connect an agent to corporate data and current external information. When every team builds its own RAG pipeline and its own MCP integration without coordination, the result is exactly Shadow AI: access to sensitive data with no central inventory, no retention policy, no auditable log. AWS solved this same pain with two launches that serve as an architecture reference, even for teams not on AWS.

Source inventory: the problem Managed Knowledge Base attacks first

Before any security policy, you need to know what exists. AWS's Managed Knowledge Base solves this with six prebuilt native connectors - Amazon S3, SharePoint, Confluence, Web Crawler, Google Drive, OneDrive - centralizing connection to corporate data sources in one managed place, instead of every team writing its own connector. That's the first practical step against Shadow AI: if every data source flows through a central inventory, there's no "invisible" connector built by an isolated team.

Governed RAG: centralized parsing and chunking, not artisanal

The "Smart Parsing" feature automatically picks the chunking strategy per content type, with multimodal processing. This might look like a technical detail, but it has a direct governance implication: when every team decides on its own how to fragment and index sensitive data, applying a consistent granular access policy becomes impossible to audit. A centralized RAG pipeline, with standardized chunking rules, is what lets you apply the same access-scope policy to any new source.

Governed MCP: multihop retrieval with a trail

Managed Knowledge Base's "Agentic Retriever" performs multihop retrieval - decomposing a complex question into multiple queries against multiple knowledge bases - and integrates with LangChain, CrewAI, and LlamaIndex via MCP. The advantage of centralizing this layer, instead of letting every agent talk directly to every source, is traceability: every multihop query gets logged in a single place, not scattered across different teams' artisanal integrations.

External grounding without opening a data gap

The other side of the problem is access to current information from the outside world - the reason Web Search on Bedrock AgentCore exists. The tool returns snippets, URLs, titles, and publication dates for the agent to reason over, while keeping "zero data egress" from the customer's AWS environment. That's the difference between an agent searching the web in a governed way and an agent with unrestricted internet access: the company's data never leaves the controlled environment, even while the agent searches for outside information.

Retention policies, logs, and human approval

None of these tools replaces policy - they make applying it consistently possible. Deciding how long indexed data stays retained, who approves adding a new source, and which queries require human approval before an action (not just a search) remain organizational decisions, not technical ones.

A ten-point checklist

  1. Source inventory - central connector, not per-team artisanal integration
  2. Data classification - what's sensitive, what's public
  3. Access scope - per agent, not per whole system
  4. Governed RAG - centrally standardized chunking and parsing
  5. Governed MCP - centralized retrieval, with a trail for every query
  6. Retention policies - defined term for indexed data
  7. Access logs - every query and retrieval recorded
  8. Human approval - for actions, not just searches
  9. Monitoring - alerts for unexpected access patterns
  10. Risk review - periodic, not just at integration creation

Sources