Bottom line: a retrieval-augmented generation (RAG) system must enforce the requesting user’s authorization before a chunk reaches the model. Filtering only the final answer is too late: an unauthorized passage may already have entered a prompt, a trace, or a provider request log.
For an enterprise knowledge base, the minimum production boundary is simple: identity and tenant context travel with every request; retrieval applies document- and chunk-level policy; the prompt receives only approved, minimally necessary content; and every decision is auditable. This is an engineering control, not a promise that a model will “behave”.
The threat model: retrieval is a data-access path
RAG changes the application’s data path. A question is embedded, matched against an index, and selected passages are sent to a model. If the vector search is global and access control is applied after retrieval, the candidate set can include material the user must not see. Prompt injection adds a second risk: untrusted text in a document can try to influence the model’s instructions. OWASP identifies prompt injection and sensitive-information disclosure among key LLM application risks.
Do not treat permissions as metadata for the UI. Treat them as a query constraint. The retrieval service, not the model, must decide whether a principal can retrieve a document, a version, or a chunk.
A production reference architecture
1. Authenticate and resolve claims: user ID, tenant, groups, role, data region and purpose. 2. Create a short-lived retrieval token signed by the policy service. 3. Query a namespace or filter that is derived from those claims. 4. Fetch approved source records from the system of record. 5. Redact or transform sensitive fields before prompt assembly. 6. Generate with citations. 7. write an immutable audit event for the decision, sources, policy version and outcome.
Keep the vector index as a discovery aid, not the authority. Store stable source IDs, classification and ACL references with each chunk, then re-authorize at fetch time. This adds a lookup and can raise latency, but it prevents stale index metadata from becoming the effective access-control system.
Where each control belongs
| Control | Enforce here | Why it matters | Failure if skipped |
|---|---|---|---|
| Tenant isolation | index namespace plus server-side filter | prevents cross-tenant candidates | plausible but wrong answer from another tenant |
| Document and group ACL | retrieval query and source fetch | applies the user’s effective rights | UI-only permission bypass |
| Field redaction | transformation before prompt construction | minimizes sensitive exposure | raw PII or contract terms reach the model |
| Prompt-injection handling | ingestion quarantine, provenance labels, tool allowlists | untrusted documents are not instructions | retrieved text changes system behaviour |
| Auditability | append-only decision event | supports investigation and tuning | no evidence of what the system exposed |
Redaction: preserve utility without sending raw records
Redaction is not a replacement for authorization. Use it after access control to minimize data sent downstream. Define policy by field class and purpose: remove personal identifiers from a troubleshooting assistant; replace account numbers with stable tokens when correlation is needed; keep a controlled link back to the source for authorized users. Run tests against multilingual text, tables and scanned-document extraction—regular expressions alone are not sufficient for all formats.
A practical rule is to make prompt construction deterministic. Log the source IDs and policy decision, but avoid storing the complete prompt or raw passages in general application logs. Restrict diagnostic traces separately and define a short retention period.
Audit logs that are useful during an incident
An audit event should answer five questions: who asked; under which tenant, group and purpose; which policy version decided; which source IDs were eligible and used; and what outcome occurred. Include request ID, retrieval timestamp, index version, redaction action, model deployment and tool calls. Hash content where evidence of integrity is needed; do not use hashes as a substitute for retention, access control or legal evidence requirements.
NIST’s AI RMF frames risk management as a continuous, documented activity. In practice, sample denied and allowed retrievals, monitor unusually broad result sets, and rehearse a revocation: remove a user or document permission, invalidate cached retrieval tokens, and confirm that the next query cannot retrieve old chunks.
Implementation checklist
• Enforce tenant and ACL filters server-side before retrieval results are returned.
• Re-check authorization against the source of record before prompt assembly.
• Version policies, chunking and embedding models; link each answer to source IDs.
• Redact by data class and purpose; test false negatives on representative documents.
• Treat retrieved content as untrusted data; never let it redefine system instructions or tool permissions.
• Log decisions and identifiers, protect traces, and exercise access revocation and incident review.
Limits and trade-offs
Fine-grained checks increase retrieval latency and operational complexity. Pre-computed ACL filters can be fast but become stale when group membership changes; source-of-record checks are stronger but cost more. Choose explicit freshness targets, cache only short-lived authorization decisions, and fail closed when policy evaluation is unavailable for sensitive collections. This article is technical guidance, not legal advice; retention, employee-data and sector-specific obligations require qualified review.
Sources
OWASP GenAI Security Project, Top 10 for LLM Applications: https://genai.owasp.org/llm-top-10/
NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
Microsoft, Content filtering and application-design considerations: https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/content-filter
Build the boundary before scaling the assistant
If your knowledge assistant is moving from a pilot to production, start with a retrieval-path review: identity claims, ACL propagation, redaction boundaries, trace access and a revocation test. Ade Christanto helps engineering teams turn that review into an implementable architecture and operating controls without turning the system into a compliance theatre project.
