Securing RAG pipelines in enterprise SaaS