Naive RAG collapses data at different access levels into one index. Here is how to build identity-aware filtering so an employee sees through the assistant exactly what they can access in the source systems.
# Enterprise Access Control: Securing RAG with RBAC and ABAC
An operations clerk asks the assistant: "What were the terms on the last deal with this customer?" The assistant searches the RAG index, finds a document from the legal department, and hands it over. The clerk has no access to that document in SharePoint. They didn't hack anything; they just asked the bot, and the bot isn't a rights subject. The retriever found the most relevant hit, the model summarized it. This is how AI produces **privileged leakage**: data the person has no access to at the source flows out through the assistant anyway.
<!--more-->
This is a fundamental defect of naive RAG. Indexing collapses data at different access levels into a single vector index, and semantic search doesn't know about permissions. The fix is an **identity plane**: RAG must return answers strictly within the rights the user actually has in the source systems — Confluence, Jira, SharePoint, PostgreSQL — and that must be provable.
## The business goal
A user gets from RAG exactly what they're allowed to see in the source systems — no more. Three promises anchor the work:
1. No answer contains data the asker lacks access to at the source.
2. Access revocation at the source propagates into RAG within minutes, not days.
3. When a regulator or auditor asks "why did this employee see this," the answer lies in the permissions, not in the retriever's luck.
## What drives the work: threat and regulator
- **Confused deputy**: the AI acts under its own identity with the full permissions of the index, rather than on behalf of the user. A classic internal-leak vector.
- **OWASP LLM**: LLM02 (Sensitive Info Disclosure), LLM06 (Excessive Agency — when RAG tools reach into systems).
- **GDPR / banking secrecy**: access to PII without a legal basis is a violation even inside the company.
- **AI Act audit**: access to high-risk data must be logged and justified.
## The architectural pattern: Identity-Aware Hybrid Filtering
The 2026 enterprise-architecture consensus: don't choose between fast pre-filtering and precise authz — combine both.
JWT(user: groups, roles, tenant_id) │ ▼ [1] Pre-filter in the vector DB by ACL metadata (recall, cheap) │ candidate chunks ▼ [2] FGA post-check: CheckBulkPermissions against each chunk's source document │ permitted chunks (precision, ReBAC/ABAC) ▼ [3] LLM → [4] OPA post-filter on the answer (field masking, forbidden combinations)
Continue reading “Enterprise Access Control: Securing RAG with RBAC and ABAC”
