RAG: Semantic Relevance Is Not Document Access Permission
RAG systems rank documents by semantic relevance, not by a user's right to access them. Without retrieval-time permissions and timely revocation, assistants can expose other people's information.
In One Sentence
Similarity between a question and a file does not grant access. A document assistant must enforce identity and permission checks before retrieved content is exposed to the model.
Why This Matters
Companies connect HR records, contracts, price lists and client data to AI retrieval. A weak boundary between teams or tenants can turn a productivity tool into a disclosure channel.
A Simple Scene
A sales representative asks, 'What price did we quote this customer?' The search retrieves another company's contract because the language is similar. The answer may look helpful while disclosing prohibited information.
What the Evidence Shows
OWASP's 2025 LLM08 guidance explicitly identifies cross-tenant leakage, retrieval poisoning and weak vector access controls. It recommends permission-aware stores, trusted ingestion and detailed retrieval auditing. These are design risks, not proof that every RAG system is vulnerable.
The Mechanism
A robust flow starts with the person's identity and approved scope, filters documents accordingly, and only then performs semantic ranking within the authorized set. Deletion and permission changes must propagate into the retrieval index.
Essential Flows
Content flow: document, classification, chunking, index, retrieval and answer. Permission flow: user, role, group, document and expiry. They must remain synchronized or stale privileges will survive.
Real Economics
Security adds engineering and possibly query latency, but reduces reputational, contractual and regulatory exposure. The relevant unit is not a generated answer; it is an authorized, traceable answer.
What Can Fail
Chunks may retain stale ACLs, shared indexes may mix tenants, and malicious files may include hidden instructions. A source citation does not cure unauthorized retrieval.
The Overlooked Idea
Authorization needs to happen before confidential text reaches the model, not just when a final answer is displayed. Hiding a result after generation may be too late if it has already been sent to a third-party service.
Critical View
Exact protections depend on storage architecture, cloud contracts and sensitivity. An unauthenticated metadata filter is not equivalent to data-layer access enforcement and adversarial tests.
Sidy's Synthesis
My synthesis: a good RAG sometimes refuses to answer. That can be a system success, not a model failure. I would test cross-customer isolation before optimizing the perceived helpfulness of answers.
AI and the Future
Future models may flag source conflicts better, but must not grant themselves permission to consult a document. Access remains a source-system rule, independently revocable and separate from linguistic quality.
What to Build
Build two confidential document sets and two test identities. Ask identical questions as each user, then revoke one permission: no retrieved excerpt or cached answer should cross the boundary.
Useful Actions
Audit ACLs before indexing. Test revocation, hidden-instruction files and multi-tenant misconfiguration. Log access decisions without unnecessarily retaining personal information.
What to Remember
Relevance ≠ permission. Citation ≠ data protection. Late revocation ≠ effective deletion.
Primary sources
Facts, figures and quotations should be traceable to the sources below. Sidy's synthesis is labeled as synthesis and does not replace sourced facts.