Permission-aware RAG is an identity project

An employee asks a knowledge assistant about a confidential reorganization. The model has never seen the underlying file directly, but the retrieval index has. If the assistant supplies a summary to a user who cannot access that file, the problem is not hallucination. It is an authorization failure.

The decision behind the technology

Many teams focus first on embeddings, chunk size and model choice. Those details matter, but they come after the security question: whose identity does the retrieval request represent, and which source documents may that person use? Indexing data can create a second information-access path. Permission checks cannot be deferred until after the model generates its answer, because the restricted material has already entered the context.

A better way to frame the work

A robust design identifies the authoritative identity provider, maps source ACLs into an index or native permission system, filters at retrieval time, verifies tenant boundaries and considers revocation and synchronization lag. Citations should point only to sources the user may open. Cache keys must include access context. A good answer from the wrong document is still unacceptable.

Put the idea under realistic pressure

Test two users with deliberately different entitlements and one document that changes from accessible to restricted. Check retrieved snippets, citations, generated summaries, logs and caches. Then test a removed group membership and a source whose ACL has not yet synchronized. That sequence tells an architect more than a broad retrieval accuracy score.

When the recommendation changes

If the existing enterprise platform already enforces source permissions correctly for the target content and use case, there may be no good reason to build a bespoke retrieval layer. The client should still verify connector permissions and synchronization semantics. Custom development is most justified when application behavior, data sources or the authorization model differ materially from packaged capabilities.

What to decide before moving forward

Before choosing the vector store, require an identity and permissions diagram, a revocation test, documented source authority, an answer-with-citation test and an explicit safe no-answer state. Review what data enters the model context and how it is logged.

References and context

Microsoft Learn, document-level access control; Microsoft Learn security practices. Review preview status at implementation.