An intern asks about holiday policy and receives a fragment from payroll. The model did not hallucinate. It found exactly what the shared index contained. That is why secure RAG starts with access control, not prompt wording.
Enforce rights before retrieval
- Identify the user and current role.
- Search only permitted document spaces.
- Build the answer only from those results.
- Show sources without exposing restricted titles.
Filtering the completed answer is too late. A filename, hit count or quoted sentence can itself be confidential. Attach tenant, team, location and confidentiality metadata to every indexed chunk.
Three tests worth more than a demo
- Two users ask the same question and receive different permitted sources.
- Revoking access removes the document from new answers immediately.
- Manipulative text inside a document cannot open another repository.
Indirect prompt injection is a content risk. Machine identities establish on whose behalf retrieval happens. The controls need each other.
For a small team, three maintained classes such as public, internal and highly restricted beat twenty theoretical roles nobody updates.
Sources
FAQ
What is permission-aware RAG?
Retrieval applies the user's current access rights before any document reaches the model.
Is a system prompt enough?
No. The search and data layer must enforce access technically.
What happens after a role change?
New queries must use the new rights immediately and stale caches should be invalidated.
Does every document need metadata?
Yes, at least an owner, visibility scope and reliable mapping to access policy.