Keep retrieval inside the user’s data boundary

Retrieval-augmented generation selects external material for a model’s context. If an over-broad search retrieves another tenant’s document, telling the model not to reveal it is too late: the confidentiality boundary has already been crossed. Retrieval authorization must be enforced before protected material reaches the model, reranker, prompt log or any external service.

Treat chunks, embeddings, titles, citations and cached answers as representations of the source document. A system can filter full text correctly while leaking a confidential title in search results. Embeddings are not anonymization: Morris et al. (2023) showed that vec2text recovers 92% of 32-token inputs exactly from their embeddings, including full names from clinical notes, so an index of opaque vectors still needs the source document’s access control. The OWASP Top 10 for LLM Applications 2026 groups these failures, plus poisoning of the corpus, as LLM09:2026 Vector and Embedding Weaknesses (/owasp-llm-top-10/2026/llm09/).

A North support user asks about renewal terms. The candidates are N1, a North policy open to support and finance; N2, a North finance-only forecast; N3, a North document whose ACL is missing; and S1, a South contract. Tenant matching excludes S1 but does not authorize N2. The retrieval contract requires both the authenticated tenant and the current source ACL before any document text reaches a reranker or model. A filter that only compares tenant names leaves same-tenant role separation unenforced.

Pipeline A sends all four candidates to an external reranker and filters afterward. Even if its final answer cites only N1, protected text has already crossed the stated boundary. Pipeline B, the code below, asks the index for the user’s tenant only, drops every chunk the current ACL does not permit, and only then reranks. The difference is observable by capturing synthetic sentinels at each stage, never real confidential documents.

Revocation introduces time. Suppose N1’s ACL changes after a cached answer was produced. A cache keyed only by tenant and question returns old content without a new permission decision, and adding the user ID to the key does not help when that same user loses access. The code includes the ACL store’s version in the key, so any permission change forces a fresh, authorized retrieval.

Citations, titles, snippets and logs are derived representations too. A system that hides body text but displays “South acquisition offer” in a forbidden citation still discloses information. Apply the same boundary to every representation and check access again when a user opens a citation. Missing ACL metadata must never default to permission.

class AclStore:
    """Authoritative document permissions. The version changes on every ACL change."""

    def __init__(self, acls):
        self.acls = {
            doc: frozenset(roles) for doc, roles in acls.items() if roles is not None
        }
        self.version = 1

    def set_acl(self, doc_id, roles):
        self.acls[doc_id] = frozenset(roles)
        self.version += 1

    def permits(self, doc_id, roles):
        return bool(
            self.acls.get(doc_id, frozenset()) & roles
        )  # no ACL record, no access


def retrieve(user, question, index, acl, rerank, cache, k=5):
    # The policy version is part of the key: a revocation is never answered from cache.
    key = (user["tenant"], frozenset(user["roles"]), question, acl.version)
    if key in cache:
        return cache[key]
    candidates = [
        chunk
        for chunk in index.search(
            question, tenant=user["tenant"]
        )  # tenant filter inside the query
        if acl.permits(
            chunk["doc_id"], user["roles"]
        )  # current ACL, checked before reranking
    ]
    result = rerank(question, candidates)[:k]  # the reranker only sees authorized text
    cache[key] = result
    return result

At ingestion, attach a stable source identifier, tenant, authoritative access policy reference, version and lifecycle state to each derived chunk. Reject or quarantine documents that arrive without ACL metadata. Make the ingester’s scope explicit: a connector with broad administrative access must not make everything it collects available to every application user.

Handle permission changes and deletion as supported workflows. Re-indexing, asynchronous events and caches create delay, so define the maximum permitted propagation time and whether a fresh source-policy check is required before context assembly. Ingestion is also where poisoned content enters: record who could write each source, and see /domains/ai-emerging/ml-security/training-data-poisoning/ for detecting and removing manipulated documents.

Derive user and tenant identity from the authenticated request. Push both filters into the vector store query, so the database returns only rows the caller may read. With pgvector, the statement below keeps each tenant in its own partition, refuses rows without an ACL, and matches the caller’s groups with the array overlap operator.

Approximate indexes such as HNSW apply WHERE conditions after scanning the index, so a selective filter can return far fewer than the requested rows and look like a recall bug. pgvector 0.8.0 added iterative index scans, which keep scanning until enough rows match or hnsw.max_scan_tuples is reached. Managed vector databases offer the same choice as namespaces, partitions or metadata filters; check that the filter runs inside the search, not on the returned top k.

Include permission context in caches or use equivalent isolation. Revalidate citations when users open them, constrain retrieval tools and treat instructions embedded in retrieved content as untrusted. Correct retrieval authorization does not authorize actions requested by the document (see /domains/ai-emerging/llm-security/prompt-injection-boundaries/).

CREATE EXTENSION IF NOT EXISTS vector;

-- One partition per tenant, so no tenant's index holds another tenant's vectors.
CREATE TABLE chunks (
  tenant_id  text      NOT NULL,
  doc_id     text      NOT NULL,
  acl_groups text[]    NOT NULL CHECK (cardinality(acl_groups) > 0),  -- no ACL, no row
  body       text      NOT NULL,
  embedding  vector(3) NOT NULL
) PARTITION BY LIST (tenant_id);
CREATE TABLE chunks_north PARTITION OF chunks FOR VALUES IN ('north');
CREATE TABLE chunks_south PARTITION OF chunks FOR VALUES IN ('south');
CREATE INDEX ON chunks_north USING hnsw (embedding vector_cosine_ops);
CREATE INDEX ON chunks_south USING hnsw (embedding vector_cosine_ops);

-- $1 tenant and $2 groups come from the authenticated session, never from the prompt.
PREPARE nearest_allowed(text, text[], vector) AS
  SELECT doc_id, body
  FROM chunks
  WHERE tenant_id = $1
    AND acl_groups && $2  -- the caller holds at least one group on the chunk
  ORDER BY embedding <=> $3
  LIMIT 20;

-- Keep scanning the index when the filters remove candidates (pgvector 0.8.0 or later).
SET hnsw.iterative_scan = strict_order;

Use synthetic sentinel strings to trace forbidden material through retrieved candidates, reranking inputs, model context, logs and citations. Test normal same-tenant access, other-tenant access, a same-tenant restricted document, revoked permissions, a document without an ACL and stale cached answers. A polite refusal in the visible answer is not a pass if the forbidden document reached a downstream model or log.

Check recall as well as exclusion: a filtered query on a large tenant should still return the requested number of allowed chunks. The RAG isolation lab at /labs/rag-isolation/ repairs a retriever that returns another tenant’s documents.

Filtering only the top results after broad retrieval can also produce misleading empty answers because unauthorized candidates crowded out permitted ones. Design the supported index filtering and authoritative checks together, then test recall for allowed documents as well as exclusion of forbidden ones.

An embedding or opaque chunk ID may not reveal readable text directly, but it still represents a protected source and can support inference or later lookup. Preserve source lineage through chunking, re-indexing and deletion so permissions are enforceable across every derivative.

Each row is a document in the North support example and whether it may reach the reranker and model. The rag-isolation lab on this page has you repair a retriever until the same cases pass.

Repair the code

RAG access control lab: Stop a retriever from returning another tenant’s documents

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. OWASP RAG Security Cheat Sheet
2. OWASP Top 10 for LLM Applications 2026 (LLM09 Vector and Embedding Weaknesses). 2026 edition (3 August 2026).
3. OWASP LLM08:2025 Vector and Embedding Weaknesses (2025 list; LLM09 in 2026). 2025 edition.
4. pgvector README: filtering, multitenancy and iterative index scans
5. Morris et al. (2023): Text embeddings reveal (almost) as much as text. arXiv, October 2023.
6. OWASP Authorization Cheat Sheet

Reference information

Tags

Access controlMulti-tenancyLLM application security

SDLC phase

DesignDevelopment

Role

DevelopersAppSec engineersPlatform engineers and SREs

ASVS 5.0.0 requirements

v5.0.0-8.2.2 · v5.0.0-8.4.1 · v5.0.0-14.2.2

Download this guide as Markdown

Continue exploring