Retrieval cannot be allowed to widen a user's permissions.
Retrieval-augmented generation connects a model to information outside its training data. In an enterprise application, it also creates a new path to sensitive information. Authorization must apply to that path, not just the final answer screen.
The authorization engineering argument
For Enterprise Architect, CIO, CISO
The situation behind the request
Two employees ask the same question of a knowledge index. One can read a confidential planning document; the other cannot. The application must not reveal the document through snippets, citations, cached context or generated summaries.
Where the obvious solution falls short
Post-generation filtering comes too late: the model has already seen the source. ACL propagation can lag behind source changes. A shared vector store can produce cross-tenant leakage if the boundary is implemented casually.
How we would approach the work
Map principal identity, source ACLs, index metadata, query-time filtering, token trust, cache boundaries and revocation behavior. Choose native permission enforcement where mature and suitable, or carefully engineered security trimming with explicit tests.
What the engagement may include
- End-to-end identity and document-permission model.
- Ingestion and ACL synchronization with revocation handling.
- Query-time authorization and cited source links.
- Negative user/tenant test suite and monitoring.
The choices worth making explicitly
A managed search platform can enforce some permissions but preview APIs, sync lag and source semantics must be reviewed. A completely custom retrieval layer has its own maintenance burden. Do not claim all permission features are universally production-ready.
What we would test before calling it ready
Try a lower-privilege identity, revoked membership, deleted content, alternate retrieval routes and metadata leakage. Validate that citations do not reveal inaccessible titles or snippets.
A sensible first step
Before comparing embedding models, prove one unauthorized user cannot retrieve one protected document. A basic security invariant is more valuable than a clever retrieval benchmark.