The integration of Large Language Models (LLMs) into Software Engineering offers efficiency but may also introduce significant risks. In Security Requirements Engineering (SRE), generic LLMs frequently exhibit omission errors — failing to identify necessary security constraints — and hallucinations. While Retrieval-Augmented Generation (RAG) mitigates factual errors, standard implementations rely on semantic similarity, creating a bottleneck that overlooks structurally necessary but semantically distinct security categories.

To address this, we propose a specialized RAG framework designed as an automated Quality Assurance mechanism. Our approach integrates a curated OWASP Knowledge Base with a novel two-stage generation pipeline. Unlike single-shot RAG, our system incorporates a deterministic threshold-based feedback loop: it statically analyzes the initial output’s coverage against the security taxonomy and triggers an adaptive compensatory generation to populate under-represented categories.

We evaluated the framework on UniClass, a web application case study, across repeated executions. Empirical results demonstrate that the pipeline achieves a stable Mean Coverage of 72% across relevant security categories with a high Applicability of 81%, as verified by one project developer. By enforcing structural completeness before implementation, our approach serves as a critical QA guardrail for secure AI-driven development.