Retrieval-Augmented Generation Authorization

The most secure and performant approach to RAG authorization. User permissions are applied as a mandatory filter before the vector similarity search executes.

• Mechanism: Appends access control list (ACL) identifiers to the query filter
• Benefit: Unauthorized documents are never scored or loaded into memory
• Trade-off: Requires up-to-date permission indexes synchronized with the source system
• Example: A query for 'Q3 revenue' only searches documents tagged with group:finance and clearance:executive

A secondary safety net where the full result set is retrieved first, then security trimmed to remove documents the user cannot access.

• Mechanism: Executes broad semantic search, then strips forbidden results
• Risk: Can leak document existence through result counts or timing side-channels
• Use Case: Complex policies where permissions cannot be expressed as simple index filters
• Best Practice: Always pair with pre-retrieval filtering for defense-in-depth

Access control granularity that restricts retrieval to entire documents based on user identity or group membership.

• Implementation: Each document chunk inherits the ACL of its parent document
• Metadata: Stored as permitted_users: [alice, bob] or permitted_groups: [legal, hr]
• Challenge: Document permissions may change after indexing, requiring re-synchronization
• Critical Rule: A single unauthorized chunk in a response constitutes a data leakage event

Grants temporary, scoped retrieval permissions that expire automatically after a defined window, eliminating standing privileges.

• Mechanism: Issues a short-lived JWT with tightly scoped claims before the RAG query
• Scope Example: {"access": ["doc:1234"], "exp": 1715000000}
• Benefit: Reduces blast radius of compromised credentials
• Integration: Works with OAuth 2.0 scopes to define granular, ephemeral access boundaries

Every retrieval event is logged with tamper-proof records capturing who queried what, when, and which documents were surfaced to the model.

• Logged Data: User ID, query text, retrieved document IDs, authorization decision, and timestamp
• Purpose: Enables forensic analysis and proves compliance with regulations like GDPR and HIPAA
• Implementation: Append-only logs with cryptographic chaining to prevent retroactive alteration
• Critical Insight: Without audit trails, RAG authorization is unverifiable and non-compliant

The most secure and performant authorization pattern for RAG. A user's security permissions are applied as a mandatory filter before the semantic query executes against the vector index. This ensures the nearest neighbor search only considers vectors from documents the user is authorized to see.

• Mechanism: Appends access control list (ACL) identifiers as metadata filters to the ANN query
• Advantage: Prevents unauthorized documents from ever entering the candidate set, eliminating leakage risk
• Trade-off: Requires real-time synchronization between the identity provider and the vector database's metadata store

The process of filtering search or retrieval results to exclude content the querying user does not have permission to see. In RAG, security trimming is the post-retrieval safety net that catches any documents that bypassed pre-retrieval filters.

• Post-Retrieval Filtering: Executes the query broadly, then strips unauthorized results before generation
• Risk: May leak document existence metadata even if content is hidden
• Best Practice: Combine with pre-retrieval filtering for defense-in-depth

The architectural component that evaluates access requests against applicable policies and issues an authorization decision. In a RAG authorization flow, the PDP is the central brain that answers: "Can user X retrieve document Y for grounding?"

• Evaluates attributes from the Policy Enforcement Point (PEP)
• Uses policies defined in Policy-as-Code (PaC) for deterministic, auditable decisions
• Must respond in sub-millisecond latency to avoid degrading retrieval performance

An access control paradigm that evaluates attributes of the user, resource, and environment against a set of policies to grant or deny access dynamically. ABAC is the ideal authorization model for RAG because it enables context-aware retrieval.

• User Attributes: Role, department, clearance level, location
• Resource Attributes: Document classification, project code, retention policy
• Environmental Attributes: Time of day, network zone, authentication strength
• Enables policies like: "Engineers can retrieve 'Internal' documents only during business hours from corporate IPs"

A metadata label applied to a data asset indicating its sensitivity level and required security controls. These tags are the bridge between human-readable policies and machine-enforceable RAG authorization rules.

• Common Levels: Public, Internal, Confidential, Restricted
• Enforcement: Tags are indexed as filterable metadata in the vector store
• Automation: Sensitive data discovery tools can auto-tag documents before ingestion
• Without consistent tagging, RAG authorization becomes arbitrary and error-prone