21 — Authorization-Aware RAG

Concept overview

Authorization-aware RAG retrieves evidence only within the caller's permitted data scope. It prevents a fluent answer from becoming an indirect read interface to documents the user cannot access. The entitlement boundary must cover chunks, parent documents, metadata, citations, caches, and any derived artifacts.

Filter before evidence reaches the model whenever the storage system supports reliable enforcement. Post-generation redaction is too late because unauthorized information may already influence the answer or enter logs. Preserve document-level and chunk-level policy metadata through ingestion, and define how revocation invalidates previously indexed or cached content.

Why it matters in production

Proof of concept

A prototype can use one public corpus. Introducing private documents requires an explicit identity and entitlement design before expanding the demonstration.

Production

Production propagates authenticated identity, enforces retrieval filters, and rechecks access when citations or attachments are opened. Missing policy metadata should deny access.

Enterprise scale

At scale, entitlement changes race with index updates and caches. Track policy freshness, use authorization-sensitive cache keys, and test cross-tenant and recently revoked access continuously.

Architecture components

Identity resolver

Establishes the authenticated user, tenant, groups, and delegated access context.

Policy service

Evaluates current document access and supplies enforceable retrieval constraints.

Secure retriever

Searches only authorized partitions or applies mandatory access predicates before returning content.

Metadata pipeline

Preserves source ACLs, classification, ownership, and policy versions on every chunk.

Citation gateway

Reauthorizes source downloads and prevents leaked direct object-store links.

The architecture, mapped

flowchart LR
 U["Authenticated employee"] --> P["Current entitlement policy"]
 P --> F["Mandatory retrieval filter"]
 Q["Question"] --> F
 D["Chunks with source ACLs"] --> F
 F --> R["Authorized evidence"]
 R --> M["Answer generation"]
 M --> C["Citation access gateway"]
 P --> C
 C --> A["Scoped answer and sources"]

sequenceDiagram
 participant I as Identity directory
 participant P as Policy service
 participant C as Answer cache
 participant R as Retrieval service
 participant U as User
 I->>P: Engagement membership revoked
 U->>C: Request prior answer
 C->>P: Check effective policy version
 P-->>C: Prior authorization no longer valid
 C->>R: Recompute within current access scope
 R->>P: Resolve current permitted documents
 P-->>R: Restricted evidence set
 R-->>U: Newly scoped answer or no available evidence

Runtime flow

1. 1

   Resolve caller

   Obtain trusted identity and tenant context independently of the natural-language query.

2. 2

   Build access predicate

   Translate current entitlements into mandatory source and chunk constraints.

3. 3

   Retrieve evidence

   Apply access restrictions before similarity ranking or before content leaves the trusted retrieval boundary.

4. 4

   Validate candidates

   Confirm policy metadata and reject stale, missing, or conflicting access information.

5. 5

   Generate scoped answer

   Supply only authorized evidence and retain its policy and source versions.

6. 6

   Deliver references

   Recheck citation access and store any cached answer under an entitlement-sensitive identity.

Searching engagement knowledge safely

Professional services · Illustrative enterprise scenario, not a reported customer outcome.

Business situation

A consulting firm stores reusable methods beside confidential client engagement documents.

The problem

A shared vector index can return a highly relevant confidential chunk to an employee assigned to another client.

Agent requirement

The assistant must find useful evidence while preserving engagement membership and document restrictions.

Architecture

The ingestion pipeline attaches source ACLs to chunks, and retrieval uses the caller's current engagement entitlements.

Runtime

• An employee asks for migration lessons; the retriever searches shared methods and only engagements the employee may access.
• The answer cites protected document routes whose gateway rechecks access when opened.

Failure scenario

If a membership revocation has not reached the index, a current policy check rejects the stale candidate before generation.

Operational impact

Measure unauthorized-candidate rejection, revocation propagation delay, authorized recall, and citation access failures. Security tests must inspect model inputs as well as visible answers.

Architecture tradeoffs

Failure scenarios & recovery

Common architecture mistakes

Filtering only final citations

Enforce authorization before evidence reaches generation.

Trusting tenant identifiers supplied in the prompt

Derive scope from authenticated context.

Ignoring parent-document access

Apply consistent policy to chunks, parents, and attachments.

When to choose this pattern

Choose it when

• RAG includes private or tenant-specific documents.
• Users have different or changing entitlements.
• Answers expose source links or cached derived content.

Avoid it when

• The corpus is deliberately public to every user.
• The storage layer cannot enforce required access boundaries.
• Source ACLs cannot be reliably preserved during ingestion.

Architecture checklist

• Propagate trusted identity into retrieval.
• Deny chunks with missing policy metadata.
• Test revocation and group changes.
• Partition caches by effective authorization.
• Reauthorize citation downloads.
• Inspect model context in cross-tenant tests.

Related concepts

• 22 — Role-Based Access Control (RBAC)
• 23 — Attribute-Based Access Control (ABAC)
• 34 — Tenant Isolation
• 63 — Metadata Pre-Filtering
• 77 — Real-time Vector Ingestion

Primary references

• NIST SP 800-162: attribute based access control
• Open Policy Agent documentation