A retrieval system can produce a beautifully cited answer to a question the user was never authorized to ask. Citations establish where text came from. They do not establish that the system had permission to retrieve it, combine it with other sources, or disclose the result to this user.
The security boundary belongs before protected content reaches the model. Once a confidential passage is in context, an instruction telling the model to hide it is a weak substitute for access control. Build the retrieval path so unauthorized documents do not become candidates for generation, while preserving enough provenance to explain every source that did.
Carry source permissions through ingestion
An ingestion pipeline needs more than text and embeddings. Capture the source system, stable document identifier, tenant, owner, classification, permission revision, and collection time. Preserve the relationship between chunks and their parent document. Without that relationship, a later access change or deletion becomes difficult to apply consistently.
Decide which system is authoritative for access. Some applications can evaluate permissions against the source at query time. Others maintain a synchronized permission index. The second approach needs explicit freshness bounds and a conservative behavior when synchronization fails. A stale copy of yesterday's group membership should not silently authorize today's confidential retrieval.
Do not assume ingestion credentials define reader permissions. A service account may read an entire workspace in order to index it, while individual employees have access to only a subset. The indexer's broad access is an operational necessity to constrain, not a permission set to inherit into every search result.
Filter using trusted identity and resource attributes
Resolve the user, organization, groups, and delegated agent from authenticated server-side context. Apply the permission predicate inside the retrieval operation or before any candidate content leaves the trusted retrieval service. Filtering an already generated answer cannot repair a disclosure that occurred when the model received the passages.
Be explicit about vector-store semantics. If the backend cannot combine the required access predicate with approximate search safely and efficiently, change the retrieval architecture. Retrieving globally and hoping the application filters every subsequent path is difficult to reason about, especially when rerankers, caches, and diagnostic logging also see the candidates.
Test both content and metadata. A title, document count, snippet, or citation URL may reveal restricted information even when the full passage is withheld. Treat the complete response surface as subject to authorization, including error messages and search suggestions.
| Stage | Required context | Boundary to verify |
|---|---|---|
| Ingestion | Tenant and source permissions | Broad collector access stays internal |
| Retrieval | Current reader and resource predicate | Unauthorized chunks never leave retrieval |
| Reranking | Same authorized candidate set | No global fallback on empty results |
| Answer and cache | Reader scope and provenance | No cross-user or cross-tenant reuse |
Keep content trust separate from access rights
A document can be legitimately readable and still contain malicious instructions or false statements. Authorization determines who may retrieve it. Content integrity and instruction handling determine how the agent should use it. Neither control replaces the other.
PoisonedRAG demonstrates knowledge corruption through attacker-inserted content in a retrieval corpus [1]. Its experiments support the existence of that attack surface; they do not establish the compromise rate of a particular production application. The operational inference is to govern corpus writes and preserve source lineage alongside reader permissions.
Separate document content from control instructions in the application design. Treat requests embedded in retrieved material as untrusted. For consequential tool calls, enforce resource and destination policy independently of the generated answer. A forged procedure document should not be able to grant the agent permission to export customer records.
Design caches around authority
Cache keys must reflect the context that determines access. Tenant ID alone may be insufficient when documents are restricted by project, matter, account, or group membership. A cached answer generated for one employee can leak information when reused for another employee in the same organization.
Consider caching authorized document identifiers or retrieval results with permission revisions rather than sharing arbitrary generated answers across identities. Revalidate when access changes. If an answer cache cannot establish that all contributing sources remain readable, expire or bypass it.
Apply the same discipline to conversation memory. A user who loses access to a document should not regain it through an agent summary stored yesterday. The correct handling depends on the application's retention obligations and user experience, but it must be an explicit policy rather than an accidental property of the chat history.
Make deletion and revocation observable
A source deletion may require removing chunks, embeddings, cached passages, generated summaries, and future retrieval references. Define which derived artifacts are in scope and which audit evidence must be retained under a separate policy. An index delete event alone does not prove that every serving path stopped disclosing the content.
Track synchronization lag and failed updates as security signals. A connector that cannot fetch changed permissions should reduce confidence in the serving index. For sensitive collections, quarantine stale documents or require a fresh source check until the feed recovers.
Use controlled canary documents to test the full lifecycle. Grant access, retrieve successfully, revoke access, and verify that search, citations, cached answers, and follow-up questions stop disclosing the canary within the documented bound. Repeat the exercise after changing group membership and deleting the source.
Evaluate the negative space
Positive tests show that an authorized person can find the right document. Negative tests should include guessed document identifiers, empty-result fallbacks, mixed-tenant batches, stale permissions, duplicated documents, and shared caches. Include cases in which the user's question itself contains a title or excerpt from a restricted source.
Inspect logs and observability exports during the tests. A retrieval service can correctly withhold data from the user while still sending complete passages to a broadly accessible trace collector. Minimize content logging and protect evidence with permissions appropriate to its sensitivity.
The acceptance condition is concrete: every returned passage has an attributable source and a valid access decision for the current reader, and every derived answer remains within that authorized material. Retrieval quality matters. A secure retrieval architecture makes the authority behind that quality equally inspectable.