Map every place information can become visible
A retrieval system can expose information before it returns a complete document. Search snippets, document titles, result counts and entity relationships may each reveal restricted facts. An AI answer adds another stage where selected evidence can be restated without its original interface controls. Begin by mapping the path from source ingestion through indexing, retrieval, context construction and answer delivery.
Include operational stores in the map. Query logs, traces, evaluation datasets and caches can retain sensitive text even when the final user interface is correct. Assign an owner to each boundary and specify what identity and policy information is available there.
Preserve the user and resource context
A request needs a trustworthy principal identity and the attributes required by the applicable policy. It also needs an unambiguous resource identity. Avoid passing an unverified user supplied role or tenant identifier into a search filter and treating the result as authorized. Resolve these attributes through the application’s trusted identity and policy mechanisms.
Decide how source permissions map to indexed documents and chunks. A single document may contain sections with different classifications, or its access may depend on a business relationship that changes over time. Record the policy version or source reference used by the index. If the mapping cannot preserve a source restriction accurately, narrow what is indexed or retrieved until that gap is resolved.
Enforce policy before evidence enters context
The safest point to exclude unauthorized evidence is before it enters the model context. Filtering only the displayed citations cannot remove information the model has already seen. Apply resource level authorization to candidate retrieval and verify the permitted evidence set before generation. OWASP recommends authorization checks on every request and default denial when no rule grants access.
Database row security can contribute to enforcement for suitable stores, but understand its scope. PostgreSQL documents policy behavior and circumstances in which privileged roles or table owners may bypass ordinary row security. Review the exact runtime identity used by retrieval services. A test performed with a restricted application account does not prove that a more privileged production connection follows the same boundary.
Handle revocation and derived representations
Permissions can change after indexing. A user may leave a group, a project can become restricted or a document may be removed. Define how quickly those changes must affect retrieval and how the system behaves while policy information is stale. For consequential access changes, evaluate current policy at request time rather than relying solely on an old index snapshot.
Treat embeddings, summaries and extracted relationships as derived information with governance obligations. They should remain associated with the source permissions and lifecycle. Specify how revocation affects caches and precomputed results, including answers that combine several documents. A response cached for one user must not be reused for another merely because the text of their question happens to match.
Test for disclosure through indirect paths
Create a permission matrix that includes permitted, denied and partially permitted resources. Test direct requests, broad searches, ambiguous entity names and follow up questions. Check that a user cannot infer a restricted document from result counts, titles, suggested questions or an explanation of why an answer is unavailable. Review the product behavior with security and domain owners.
Also test cross tenant identifiers, modified filters, expired sessions and recently revoked access. Include retrieved text that attempts to persuade the system to reveal other documents or change its instructions. The model should not be the component responsible for deciding whether a user is authorized. Policy enforcement belongs in trusted application boundaries with observable, testable behavior.
Keep an auditable but proportionate record
Record the principal, policy decision, resource references and relevant request identity needed for investigation. Avoid logging complete restricted passages by default. Restrict access to the audit trail and define retention appropriate to its purpose. An investigation should establish which evidence was permitted and used without creating an uncontrolled secondary copy of the entire source collection.
Review authorization failures and stale policy incidents as operational signals. Maintain a way to disable a source or narrow retrieval if its permission mapping becomes unreliable. Recheck access to answers and their supporting evidence after source changes, user departures and infrastructure recovery.