Enterprise RAG Security: Permissions and Tenant Isolation

A relationship manager asks an assistant for the onboarding requirements of a corporate client. The answer is polished, cites a policy, and is wrong. The cited procedure expired last quarter; the current exception applies only to a different jurisdiction. The problem was not the model's fluency. It was the system's treatment of organizational knowledge as interchangeable text.

Retrieval-augmented generation is often described as a pipeline: ingest documents, chunk them, embed them, retrieve similar passages, produce an answer. That describes an information retrieval mechanism. It does not describe the enterprise contract the answer must honor.

Conceptual reference pattern; enterprise policies and integrations determine implementation.

Information has jurisdiction, authority and time

A chunk is rarely meaningful without its parent. Store document ID, revision, effective dates, status, owning function, source system, classification, permitted audience and applicable country or business unit. A result from a rescinded policy should not outrank the current approved version because its wording is semantically closer to the question.

The ingestion process must preserve provenance and document-level permissions; inherited permissions also need to be re-evaluated when group membership changes. Avoid a shared embedding store in which every agent can retrieve everything and is merely instructed not to reveal it.

Apply authorization before the model sees the evidence

Resolve the caller's identity, organizational context and task purpose. Filter candidate sources by enforceable access policy, then rank only eligible evidence. Recheck entitlements when fetching the underlying passages. Identity and authorization should be independent of model instructions.

Tenant isolation is more than an organization ID in a prompt. It includes the indexing boundary, source connectors, caches, retrieval queries, tool credentials, logs, embeddings and feedback datasets. A leaked search result can be a breach even if the final answer looks innocuous.

Retrieval needs a quality contract

Use a combination of metadata constraints, lexical and semantic retrieval, version precedence and reranking where appropriate. Each answer should distinguish evidence that directly supports a claim from a model inference. Contradictory approved sources should cause escalation, not an improvised reconciliation. When no valid evidence is found, say so and show the next human or system step.

For the onboarding example, retrieval should first identify the contracting entity and jurisdiction. It should then select in-force policies and applicable product rules, surface contradictory instructions for review, and return citations that a user can open with the same permissions. A query without enough context should request the missing dimension rather than assume a default country.

Test access and correctness together

Construct an evaluation set including outdated policy traps, deliberately conflicting guidance, denied documents, cross-tenant requests, missing jurisdiction, revoked access, and manipulated source text. Measure citation support, eligibility of retrieved material, abstention behavior, staleness, retrieval latency and access-control failures. A high answer-quality score from an unrestricted test corpus is not evidence of enterprise readiness.

From a knowledge feature to a governed process

A usable answer may trigger document collection, task assignment or a policy exception. That transition introduces an additional decision boundary: the assistant can propose a next step without acquiring authority to execute every step. Archy places enterprise knowledge within a broader agent and workflow orchestration layer; the organization's access policies and source systems remain the authority.

A minimal RAG access-control test matrix

Test caseExpected behaviorEvidence to retainUser loses access after indexingDeny retrieval and invalidate affected cachesRevocation time and denied document IDsRequest targets another tenantReturn no cross-tenant evidenceTenant scope and authorization decisionOld and current policies conflictSelect the in-force version or escalateDocument revisions and effective datesNo eligible evidence supports the answerAbstain and route to the responsible ownerEvidence search and unresolved question

For the related architecture decisions, see AI Contract Review: Evidence and Human Approval; AI Agent Governance: Identity, Authority and Accountability.

Further reading

NIST Generative AI Profile; OWASP LLM Top 10, including vector and embedding weaknesses and sensitive information disclosure.

Explore Archy Platform.