A search index finds the perfect paragraph for a question. It comes from a project the current user cannot access. Relevance has done its job; authorization still has to do its own before that paragraph reaches the answer.
Check access during retrieval
Use a synthetic collection with two project teams and one shared handbook. A user in the first team can retrieve its project material and the handbook. A user in the second team has a different view. The application must apply those boundaries to the retrieval operation using a trustworthy identity and current policy.
OWASP’s RAG guidance addresses access controls across ingestion, retrieval and generated output. The practical consequence for this example is to preserve the permissions associated with a source throughout the path that can expose it.
Source: OWASP · RAG Security Cheat Sheet.
Protect every version of the content
The original document is only one representation. Its title may appear in a result list. A snippet may be returned without a full-document link. A generated answer may summarize the restricted paragraph. A cache may retain that answer for a later caller.
Inspect those outputs separately. Hiding a citation while leaving its facts in the answer does not preserve the boundary. Shared caches need a design that accounts for access scope, and membership changes need a way to affect results that were prepared earlier.
Test for unintended disclosure
Use invented project names and distinctive synthetic facts so a restricted passage can be recognized without exposing real material. Run the same questions under each test identity. Then remove a membership, withdraw a document and retry a request that previously returned a cached answer.
- A user receives only material allowed for their current project memberships.
- Result titles and snippets follow the same access decision.
- A cached answer does not cross from one access scope into another.
- Removing access affects the paths that can still return the material.
Treat retrieved text as data
A document can contain a sentence that looks like an instruction to the assistant. That sentence is source material to interpret within the application’s rules. It cannot grant permission to search another project or invoke a privileged tool.
The model may help explain allowed material, but the surrounding system decides which material and actions are available. That division lets retrieval improve the user’s work while keeping the application’s existing responsibilities visible and testable.