Enforce RAG Retrieval Access Controls
Apply current user and tenant permissions before RAG chunks enter model context, including snippets and caches.
A retrieval system can return a document even when the application UI would deny the same user access to its source. The security question is whether the retriever applies current permissions before it places text in model context. Post-answer filtering is too late; the model has already seen the material.
OWASP's multi-tenant guidance emphasizes isolation across shared storage and retrieval paths. Map the source system's ACL into index metadata, but keep a trusted identity and membership check at query time. A vector similarity score is not an access decision.
ACL mapping table
| Source field | Index field | Query-time check |
|---|---|---|
| Tenant ID | Immutable tenant key | Must match authenticated tenant |
| Document owner | Owner principal | Verify current ownership or grant |
| Role grant | Allowed role set | Resolve current role, not stale UI state |
| Visibility | Public or restricted flag | Public must be an explicit source rule |
| Revocation time | Version or tombstone | Exclude removed document and chunks |
The indexer must attach the same ACL to every chunk, title, summary, and embedding that can appear in results. Search suggestions and result counts also need review because they can reveal names before a document body is opened. If a source system changes permissions, choose a bounded propagation time and fail closed when the index version is uncertain.
Denial fixture
Create two owned synthetic tenants with distinct marker phrases. Give a user access to one tenant, then query for both markers. The allowed marker should appear. The other marker must not appear in snippets, citations, counts, or model context. Next, revoke the user's grant and repeat the query after the documented propagation window. Test a cached query and a re-indexed document as separate paths.
Inspect the retrieval API response before model generation. If the model invents a marker, that is a different failure from unauthorized retrieval. Preserve evidence for each layer: source ACL, indexed metadata, query filter, returned IDs, and final answer. A test with only denied results can be misleading if the retriever is broken, so keep the positive control. Hold release when the index cannot identify the owner of a returned chunk.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.