A retrieval-augmented generation system should retrieve only content the requesting user may access and continue respecting access changes throughout the answer lifecycle. Permission handling must cover source ingestion, retrieval, citations, conversation history and caches. Asking the model not to reveal restricted material is not a substitute for an enforced access boundary.
Let’s plan your RAG access boundaries.
Bring your workflow and the decisions you need to make. We’ll help you clarify requirements, review the trade-offs and define a practical next step.
Carry authority with the document
Identify the authoritative permission source and how user or group identity reaches retrieval. Record which documents, versions and derived chunks each rule applies to. Do not assume that copying a document into an index preserves its original access controls automatically.
Microsoft's document-level access overview describes permission enforcement in search and distinguishes different approaches. Verify the capabilities and maturity of the actual implementation rather than assuming every connector handles permissions identically.
Test access through its lifecycle
| Change or event | Requirement | Evidence to inspect |
|---|---|---|
| Document ingested | Permission metadata preserved correctly | Source-to-index mapping |
| User asks a question | Retrieval uses current authorised scope | Returned document identifiers |
| Citation opened | Destination rechecks access | Denied direct-link case |
| Membership removed | Access changes propagate under an agreed target | Revocation test and measured delay |
| Answer cached | Cache cannot cross permission boundaries | Different-user test |
| Conversation reopened | Historical content follows the approved policy | Access-change scenario |
Specify how the system behaves while permission synchronisation is unavailable. A connector outage should not silently broaden access.
Separate shared knowledge from shared answers
For a hypothetical internal assistant, two staff members may ask the same question but have different document access. Reusing an answer solely because the question text matches can reveal material outside one person's scope.
Include tenant, identity scope, source version and relevant policy in the cache design. Decide whether historical answers remain visible after source access is revoked; have the responsible security and records owners approve that behaviour explicitly.
Evaluate denial paths
Create authorised test identities with deliberately different access. Ask about restricted content, inspect retrieval traces and attempt to open citations directly. Include permission changes after an answer is generated.
Measure both inappropriate disclosure and unnecessary refusal. A system that blocks everything is not useful, while a fluent answer does not establish access correctness.
RAG permission questions
Can the language model filter restricted facts after retrieval?
Do not rely on that as the primary boundary. Enforce access before restricted content enters the answer context.
Is document access checked only during ingestion?
That is insufficient when permissions can change. Define query-time checks and the update path appropriate to the architecture.
Connect this plan to business-data AI vendor questions, then review the retrieval boundary with Drema's AI team.
This article explains what to build, not legal advice. Rules change; confirm against the current official text before relying on it.