Least Privilege Retrieval

Dynamically restricts the search space before the vector similarity operation executes. Instead of searching the entire knowledge base, the system injects metadata filters derived from the user's session token.

• Mechanism: Transparently rewrites the user's natural language query to append AND (department='finance' AND classification='internal').
• Benefit: Prevents the retrieval engine from even scoring unauthorized documents, eliminating the risk of sensitive chunks appearing in the top-K results.
• Example: A marketing intern searching for 'Q4 strategy' will only scan marketing-owned documents, never seeing executive board materials.

Acts as a safety net that inspects retrieved text chunks after the search but before insertion into the LLM prompt. A specialized scanner identifies and neutralizes sensitive entities that may have bypassed pre-filters.

• Process: Uses Named Entity Recognition (NER) to detect PII, secrets, or out-of-scope data, then applies data masking or redaction.
• Criticality: Essential for unstructured data where metadata filtering alone cannot guarantee field-level security.
• Example: A support bot retrieves a log file; the post-retrieval guard automatically redacts the customer's email and IP address before the LLM sees the text.

Propagates the end-user's identity through the entire RAG pipeline using short-lived, just-in-time credentials. The system never uses a static service account with broad access.

• Identity Propagation: The user's OAuth token is passed to the Policy Decision Point (PDP), which issues a scoped, ephemeral token for the vector store.
• Zero Standing Privileges: Access rights exist only for the duration of the single retrieval call, then immediately expire.
• Example: A contractor queries the knowledge base; the system grants read access to Project Alpha documents for exactly 500ms, then revokes it.

Applies access control lists (ACLs) directly to individual vector embeddings, not just the parent document. This enables fine-grained semantic security.

• Implementation: Each chunk in the vector database carries metadata tags like clearance: 4 or group: legal-team.
• Hybrid Filtering: Combines pre-retrieval filtering on chunk metadata with post-retrieval content scanning for defense in depth.
• Example: A 100-page contract is chunked; the LLM retrieves the 'Termination' clause but is blocked from retrieving the adjacent 'Pricing' chunk due to higher sensitivity.

Re-evaluates access policies throughout the retrieval session rather than relying on a single initial authentication check. The system monitors for contextual changes that alter the risk profile.

• Triggers: Session revocation occurs if the user's device posture changes, location shifts to a restricted geo, or anomalous query patterns are detected.
• Integration: The Policy Enforcement Point (PEP) maintains a persistent connection to the PDP to validate every retrieval request in real-time.
• Example: A user copies a retrieved document chunk; the DLP guard detects the clipboard event and terminates the retrieval session immediately.

Records every retrieval event with cryptographic integrity to create a non-repudiable trail for compliance and forensic analysis.

• Logged Data: Captures the user identity, exact query, retrieved chunk IDs, authorization decision, and timestamp.
• Purpose: Enables security teams to answer 'Who accessed what data and when?' for regulations like SOX or GDPR.
• Example: An auditor reconstructs a data leak incident by tracing the exact retrieval path that exposed a sensitive financial figure to an unauthorized analyst.

The architectural component in a RAG pipeline that intercepts the retrieval request and enforces the access decision by filtering or blocking the response before it reaches the LLM. The PEP acts as a security gate that queries the Policy Decision Point (PDP) and then strips unauthorized chunks from the retrieved context.

• Sits between the retriever and the prompt assembler
• Can operate in pre-retrieval or post-retrieval mode
• Must handle sub-millisecond latency to avoid degrading generation speed

The process of applying permission checks to individual text segments within a vector database. Unlike document-level security—which grants or denies entire files—chunk-level authorization ensures that only authorized fragments surface during semantic search. This is critical when a single document contains mixed sensitivity levels.

• Requires metadata tagging at ingestion time
• Uses boolean filters on vector DB queries
• Prevents sensitive paragraphs from leaking into prompts even if the parent document is partially authorized

The secure transmission of the end-user's authenticated identity context through every layer of the RAG pipeline. Without proper propagation, the retrieval engine cannot apply user-specific permissions and defaults to a service account with overly broad access. This is the mechanism that makes least privilege retrieval possible.

• Uses JWT tokens or OAuth2 assertions passed via headers
• Requires tight integration between the IdP, API gateway, and vector store
• Prevents confused deputy problems where the retriever acts with its own privileges instead of the user's

An authorization technique where initial search results are re-ranked or redacted after the vector similarity search completes. The retriever first fetches a broader set of candidates for high recall, then a security filter strips out documents the user is not permitted to see before the LLM receives the context.

• Often implemented as a re-ranking step with access checks
• Trades slight latency for higher recall vs. pre-retrieval filtering
• Commonly paired with PII detection and redaction modules

A security practice that provisions ephemeral, short-lived credentials for a RAG system to access a specific data source only at the exact moment the retrieval is required. JIT eliminates standing privileges and reduces the blast radius if the retrieval pipeline is compromised.

• Credentials typically expire in seconds to minutes
• Requires a secrets broker like HashiCorp Vault or AWS STS
• Aligns with the principle of zero standing privileges—a natural complement to least privilege retrieval