RAG document permissions: identity, retrieval filters and source ACLs

RAG turns source documents into searchable chunks. Follow that data path when designing document permissions: who made the request, which chunks are eligible, and when the system stops using old permissions after a source change. Successful ingestion and correct answers cannot, by themselves, establish that access controls work.

Establish a trusted identity and authorization decision

The backend should obtain user and tenant identity from an authenticated session, then resolve eligible groups or resources through a trusted authorization service. A department name, group ID or model-inferred role supplied by a visitor cannot directly grant access. Check every protected entry point, including search, source retrieval and download. Deny the requested access when no valid authorization decision is available. OWASP authorization guidance

Azure AI Search security filters illustrate this distinction: they compare identifier strings in a query and do not authenticate those strings. The application must construct trustworthy conditions and prevent callers from bypassing its protected query endpoint. Microsoft security filter documentation

Choose isolation and query conditions separately

Index isolation, retrieval filters and source authorization queries can work together. Map the data and request paths before assigning each layer its responsibility.

Filter timing can also affect result quality. Azure AI Search distinguishes vector prefiltering from postfiltering: filtering after candidate selection can miss eligible results, while prefiltering can increase query work. These are implementation-specific trade-offs. Compare the actual index, filter selectivity and query set before treating a mode as a performance guarantee across databases. Microsoft vector filter documentation

Treat source permission updates as separate work

Chunks need traceable source identifiers and applicable permissions, with access evaluated during retrieval. Do not assume a chunking tool preserves ACLs automatically or ask a prompt to decide which secrets may be disclosed. Citation titles, summaries and shared answer caches can also reveal restricted content. OWASP RAG security guidance

Checking permissions at query time does not establish immediate revocation. Indexes, replicas, identity tokens, group resolution and caches have their own update behavior. The SharePoint indexer preview documentation reviewed on October 12, 2026, for example, describes API-dependent ACL updates and additional refresh requirements for parent permissions. Verify the version and source features used in the proposed deployment. Microsoft SharePoint ACL limitations

Deliver evidence that can be rerun

Put identity sources, authorization services, index scope, update events and failure behavior on the same request-path diagram. Assign an owner to each connection and record versions and test results. Recheck these decisions when changing a connector, database or query mode.

Use the RAG permissions acceptance checklist to test revocation, caches and citations. For a discussion of actual sources and integration scope, start with the RAG knowledge service.