Pre-Retrieval Filtering

The process of transparently modifying a user's natural language query to inject metadata filters or scope limitations that enforce data access policies during retrieval.

• Mechanism: An interceptor parses the user's query and appends restrictive clauses (e.g., WHERE department='finance') based on the user's identity context.
• Transparency: The end-user is unaware of the modification; the system silently constrains the search space.
• Example: A query for "Q4 revenue" is rewritten to "Q4 revenue AND region:EMEA" for a European sales manager, preventing access to Americas data.

A technique used in vector databases to restrict search results by applying boolean conditions to the key-value attributes associated with each document chunk before the similarity search runs.

• Pre-filtering: Filters are applied to metadata indexes to create an allowlist of document IDs before the expensive vector distance calculation.
• Attributes: Common filters include classification_level, department, project_id, and date_range.
• Performance: Pre-filtering dramatically reduces the candidate set, lowering query latency and compute cost by avoiding unnecessary vector comparisons.

The secure transmission of the end-user's authenticated identity context through the RAG pipeline layers to ensure the retrieval engine applies the correct user-specific permissions.

• Context Passing: The user's JWT or session token is forwarded from the application layer to the retrieval service without alteration.
• Trust Chain: The vector database trusts the identity asserted by the upstream Policy Enforcement Point (PEP) .
• Criticality: Without proper propagation, the retrieval engine defaults to a generic service account, bypassing all user-specific access controls.

A physical data segregation approach where separate vector indexes are maintained for different security domains, and the query is routed to the appropriate index based on user authorization.

• Isolation: Highly sensitive data resides in a dedicated index with its own access controls, completely invisible to unauthorized queries.
• Routing Logic: A Policy Decision Point (PDP) determines which index(es) a user is permitted to query before the search is dispatched.
• Trade-off: Provides the strongest security guarantee but increases infrastructure complexity and can fragment relevant context across indexes.

The principle of granting a RAG system or user only the minimum necessary data access required to answer a specific query, reducing the blast radius of potential data leaks.

• Dynamic Scoping: Access is not based on static roles alone but is scoped dynamically to the specific context of the current request.
• Implementation: Combines Attribute-Based Access Control (ABAC) policies with query-time metadata injection to enforce granular, need-to-know boundaries.
• Outcome: Even if a prompt injection attack succeeds, the attacker can only exfiltrate data within the tightly scoped permission boundary.

A defense-in-depth security strategy that combines pre-retrieval and post-retrieval filtering techniques to minimize the risk of exposing sensitive data while maintaining high recall for authorized content.

• Pre-Retrieval: Restricts the search space using metadata and index partitioning to exclude unauthorized documents before the vector search.
• Post-Retrieval: Acts as a safety net, re-ranking or redacting results that may have slipped through due to misconfigured metadata or edge cases.
• Synergy: Pre-retrieval handles the coarse-grained exclusion; post-retrieval handles fine-grained field-level redaction and PII scrubbing.

A transparent technique where the user's natural language query is programmatically modified to enforce access boundaries. The system appends or restructures the query to include security predicates.

• Example: A user asks 'What is our Q3 revenue?' The rewriter transforms it to 'What is our Q3 revenue for the EMEA region?' based on the user's group membership.
• Implementation: Often uses an LLM call itself to perform the rewriting, which introduces latency but handles complex semantic constraints.
• Key Distinction: Unlike metadata filtering, this alters the semantic intent of the query, not just the database filter parameters.

The secure plumbing that transmits the end-user's authenticated context through every layer of the RAG pipeline. Without identity propagation, the retrieval engine cannot know who is asking the question.

• Flow: The user's JWT or session token is passed from the application gateway to the orchestrator, then to the vector database connector.
• Critical Security Property: The system must never trust a client-supplied user ID; it must validate the token cryptographically at each hop.
• Risk: A broken propagation chain results in the system defaulting to an anonymous or over-privileged service account, bypassing all pre-retrieval filters.

A defense-in-depth strategy that combines pre-retrieval and post-retrieval filtering. Pre-retrieval restricts the search space for efficiency, while post-retrieval acts as a safety net for edge cases.

• Why Both?: Metadata filters can be too coarse (blocking relevant, authorized content) or miss nuanced field-level restrictions. Post-retrieval redaction catches what slips through.
• Trade-off: Adds latency from the secondary check but is essential for high-assurance environments where a single leak is unacceptable.
• Architecture: The pre-retrieval phase returns a candidate set; a fast, rules-based post-filter scans each chunk for PII or unauthorized field-level data before the LLM sees it.

The security principle dictating that a RAG system should access only the minimum data necessary to answer a specific query. Pre-retrieval filtering is the primary technical enforcement mechanism for this principle.

• Goal: Reduce the blast radius. If a prompt injection attack succeeds, the attacker can only exfiltrate data from the narrowly scoped set of documents the filter allowed.
• Implementation: Dynamically derive the minimal set of permissions from the user's active session and the query's inferred intent, rather than granting broad, static access.
• Contrast: Opposite of a 'fetch all then filter' approach, which temporarily exposes unauthorized data in memory.