Screen RAG Ingestion Permissions
Record who can add RAG documents, how each source is classified, and which access rules survive indexing.
Retrieval security starts when a document enters the corpus. A later query filter cannot repair an index that lost the owner, tenant, or source trust level. Before ingestion, decide who may submit material, who may approve it, and which users may later retrieve it.
OWASP's authorization guidance calls for access decisions at each protected request. Apply that principle to document upload and indexing as separate actions. A file that an employee can read is not automatically suitable for every assistant or tenant. Do not let an agent import arbitrary URLs, repositories, or cloud drives just because a connector can reach them.
Ingestion register
| Field | Example decision |
|---|---|
| Source owner | Named team or tenant, not a free-text model guess |
| Submitter | Authenticated account allowed to add this collection |
| Trust level | Internal approved, customer supplied, or untrusted external |
| Classification | Public, internal, confidential, or restricted |
| Retrieval ACL | Role and tenant rule copied into index metadata |
| Review state | Quarantine, approved, rejected, or expired |
An ingestion worker should receive trusted ownership metadata from the application, not from document text. Validate file type, size, and allowed source. Preserve the original reference and a content hash. If extraction fails, leave the item out of search rather than indexing an unlabeled fragment. A quarantine state gives reviewers time to inspect unexpected instructions, private data, and duplicate material.
Check the boundary
Use two synthetic tenants. Let tenant A upload an approved document and confirm it appears only in A's collection. Attempt an upload with a client-supplied tenant B field and require rejection or safe rebinding to trusted context. Then change A's membership and confirm the document does not become public through a stale index.
Test deletion and re-indexing too. Old chunks, summaries, embeddings, and cached snippets can outlive the source record. Make the ingestion receipt list all derived identifiers so a removal job can find them. Record what the team has verified and what remains unknown. A successful upload response alone does not show that ownership and retrieval controls survived indexing.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.
Sources
- OWASP Top 10 for LLM ApplicationsAccessed
- OWASP Authorization Cheat SheetAccessed