# Retrieval cannot be allowed to widen a user's permissions.

> Let AI find answers in company documents while respecting the access rules those documents already have. Search should not become a back door to confidential information.

Canonical URL: https://marmation.com/expertise/permission-aware-rag/

## The decision

Could an employee learn something they could not open in the source system?

Check access before sending any protected content to the model. Apply the same rules to titles, citations, saved responses and later requests, including after an employee changes roles.

## Two employees ask the same question with different access

Two employees ask the same question of a knowledge index. One can read a confidential planning document; the other cannot. The application must not reveal the document through snippets, citations, cached context or generated summaries.

## Hiding the final answer can be too late

Post-generation filtering comes too late: the model has already seen the source. Copied access rules can lag behind permission changes in the source system. A shared search index can expose one customer’s information to another if customer-account restrictions are not enforced in every retrieval path.

## Carry source permissions through search and saved responses

Trace the signed-in user from the source system to the index, model request, answer and saved response. Preserve source access-control lists (ACLs), verify the identity represented by tokens and enforce current permission checks before protected text is retrieved. Plan what happens while permission changes are still synchronizing. Use mature native controls where suitable; a custom permissions copy needs explicit synchronization, revocation and failure tests.

## The identity, permission and revocation checks to build

- End-to-end identity and document-permission model.
- Ingestion and ACL synchronization with revocation handling.
- Query-time authorization and cited source links.
- Negative user/tenant test suite and monitoring.


## Verify the selected platform rather than assuming it enforces access

A managed search platform can enforce some permissions but preview APIs, sync lag and source semantics must be reviewed. A completely custom retrieval layer has its own maintenance burden. Do not claim all permission features are universally production-ready.

## Try removed access, alternate routes and revealing citations

Try a lower-privilege identity, revoked membership, deleted content, alternate retrieval routes and metadata leakage. Validate that citations do not reveal inaccessible titles or snippets.

## Prove a protected document stays protected

Before comparing embedding models, prove one unauthorized user cannot retrieve one protected document. A basic security invariant is more valuable than a clever retrieval benchmark.

## Related reading

- [Company knowledge should be useful to the people allowed to use it.](https://marmation.com/solutions/enterprise-knowledge-systems/)
- [Private AI is not one architecture.](https://marmation.com/solutions/private-enterprise-ai/)
- [Autonomy should be earned, not assumed.](https://marmation.com/expertise/ai-agent-orchestration/)