AI & LLM Engineering · 2 min read
Building a Permission-Aware RAG System for Business Data
Retrieval quality is irrelevant if users can retrieve documents they should never see. Here is how identity and authorization belong in every RAG layer.
A business search assistant often indexes contracts, support history, internal policies and customer records in one retrieval system. Semantic similarity does not understand organizational permission. If authorization is applied only after retrieval, sensitive text may already have entered the model context, logs or cache.
Carry identity through the complete request
The retrieval service should receive a verified identity and an authorization scope created by application code. That scope can include tenant, team, role, document classification and explicit grants. Do not accept tenant identifiers directly from untrusted model arguments or browser fields without checking them against the authenticated session.
Attach access metadata during ingestion
Every chunk needs a stable document identity and access metadata inherited from its source. Updates to permissions must propagate to the index predictably. For strict isolation, separate indexes or namespaces may be appropriate. Shared indexes can work when the database guarantees filtered search and the filter cannot be omitted by callers.
- Store source, tenant, classification and access group on every chunk
- Reject unscoped retrieval requests at the service boundary
- Keep embeddings and source files under the same retention policy
- Invalidate cached answers when access or source content changes
- Return source identity with every retrieved passage
Treat citations as a security feature
Citations let the application verify that an answer is supported by documents in the authorized result set. The UI should link only to sources the current user can open. When evidence is missing or conflicting, the assistant should say so rather than filling gaps from general model knowledge.
Test attempts to cross boundaries
Evaluation must include adversarial requests: asking for another customer, quoting a remembered confidential phrase, changing identifiers inside a prompt and requesting summaries across inaccessible folders. Test cache keys and conversation memory too. A correctly filtered search can still leak data if an answer from one user is reused for another.
Permission-aware RAG is easier to build when authorization is a first-class input from the start. Adding it after documents, embeddings and caches are already shared usually requires redesigning the system at its most sensitive boundary.