Information Barrier

Enforces separation through software-defined policies rather than physical air gaps. In RAG architectures, this is implemented via metadata filtering and attribute-based access control (ABAC) at the vector database level.

• Queries from one business unit never scan embeddings belonging to another
• Policies are evaluated at the Policy Decision Point (PDP) before retrieval executes
• Enables multi-tenant knowledge bases on shared infrastructure without cross-contamination risk

Prevents scenarios where an AI agent retrieves material non-public information from one client's corpus to inform responses for a competitor. Common in investment banking, legal tech, and consulting deployments.

• Example: A M&A advisory bot must never surface Deal A documents when answering questions about Deal B
• Enforced via chunk-level authorization tied to deal-specific metadata tags
• Violations trigger immediate audit logging events for compliance review

Acts as a containment control when a retrieval pipeline is compromised or misconfigured. Even if an attacker gains access to one pipeline, the barrier prevents lateral movement into adjacent data stores.

• Implements zero-trust retrieval principles between pipeline segments
• Uses ephemeral tokens scoped to a single pipeline's index partition
• Complements Data Loss Prevention (DLP) monitors that inspect cross-barrier traffic

Mandated by frameworks like SEC Rule 17a-4, GDPR data minimization, and HIPAA segmentation requirements. Information barriers provide auditable proof that sensitive data remained isolated.

• Immutable audit trails record every query and the barrier policy applied
• Supports continuous authorization models that re-evaluate access as user context changes
• Demonstrates compliance during regulatory examinations through policy-to-log traceability

Barriers are enforced at the Policy Enforcement Point (PEP) within the RAG pipeline, not at the application layer. This ensures no retrieval path bypasses the control.

• Pre-retrieval filtering restricts the vector search space before similarity scoring
• Post-retrieval filtering redacts unauthorized chunks from results before LLM injection
• Identity propagation carries the user's clearance context through every pipeline hop

Named after the historical financial services practice, a Chinese Wall in AI systems creates an informationally hermetic boundary between retrieval domains. Once a user accesses one side, the barrier dynamically restricts access to the other.

• Implements context-aware access that updates permissions based on prior retrieval history
• Prevents tainted knowledge from crossing into unrelated generation contexts
• Critical for professional services firms managing competing client engagements simultaneously

The architectural gatekeeper that actively intercepts retrieval requests to enforce segregation. The PEP sits inline between the retriever and the generator, executing the decision made by the Policy Decision Point.

• Function: Blocks or filters responses in real-time.
• Placement: Typically a proxy or middleware layer.
• Criticality: Prevents data spillage by acting as the physical manifestation of the barrier.

A fine-grained security mechanism that applies permission checks to individual text segments within a vector database. Unlike document-level security, this prevents sensitive paragraphs from leaking even if the rest of the document is authorized.

• Granularity: Operates on the embedding index level.
• Mechanism: Attaches ACLs to vector metadata.
• Use Case: Preventing a single confidential sentence from appearing in a generated summary.

A restrictive authorization technique where the search space is constrained before the vector similarity query executes. By injecting metadata filters into the query, unauthorized document chunks are never retrieved, making them invisible to the pipeline.

• Efficiency: Reduces computational load on post-processing.
• Security: Guarantees unauthorized data never leaves the database.
• Trade-off: Requires highly accurate metadata tagging.

A reactive security layer that re-ranks or redacts results after the semantic search completes. This acts as a safety net for pre-retrieval methods, stripping out documents that slipped through due to misclassification or complex access logic.

• Function: Applies fine-grained content inspection.
• Mechanism: Often uses NER for PII detection and redaction.
• Risk: Higher latency; data is temporarily exposed to the filtering process.

A security architecture assuming no implicit trust within the network. Every retrieval request, regardless of origin, must be explicitly authenticated and authorized. This is the foundational philosophy for building effective Information Barriers.

• Principle: 'Never trust, always verify.'
• Implementation: Requires continuous authorization and strict identity propagation.
• Outcome: Minimizes the blast radius of compromised credentials.

A strategy for monitoring and blocking the exfiltration of sensitive data by inspecting the content of prompts and retrieved context. DLP systems enforce Information Barriers by detecting patterns like credit card numbers or classified code names in the data flow.

• Detection: Uses regex, fingerprinting, and ML classifiers.
• Action: Can block, mask, or audit the violating transmission.
• Integration: Sits as a final outbound guardrail before the LLM response.