SentinelRAG: Secure Code Q&A with Policy-Aware RAG System