LLMs, GenAI, RAG, agents, evaluation · insight-0605
Apply document permissions inside the retriever, before the model sees anything
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- Applied AI, ML engineer
- Industries
- saas, banking
Summary: situation, action, reason, boundary
Situation
An internal assistant indexes documents with different audiences, such as HR cases, board papers and public FAQs, in one vector store.
Action
Store access-control metadata per chunk, filter by the requesting user's entitlements in the retrieval query, and test with users of different roles.
Reason
Anything placed in the context window can appear in the output. OWASP lists sensitive information disclosure and vector and embedding weaknesses as distinct LLM application risks; a prompt instruction is not an access control.
Boundary
Multi-tenant SaaS, enterprise search, any corpus with mixed confidentiality.
Symptom or risk
A user receives content they are not entitled to because the retriever ranked it highly and the prompt only "asked" the model not to reveal it.
Exceptions
Fully public corpora.
Trade-offs
Per-user filtering lowers cache reuse and complicates precomputed results.
Pitfalls
Syncing permissions only at ingestion, so revoked access persists in the index until the next rebuild.
Lessons and concepts
Claims and their sources
OWASP's 2025 list names LLM02 Sensitive Information Disclosure and LLM08 Vector and Embedding Weaknesses as separate risk categories for LLM applications.