Permission-aware RAG: keep private answers inside the right account

A retrieval-augmented assistant can produce a well-written answer from documents the user was never allowed to see. Relevance is not permission. In B2B SaaS, access control must travel from the source document through indexing, retrieval, answer generation and every cache or citation that exposes the result.

Carry access metadata into the index

Record a stable source identifier, owning workspace, applicable access metadata and source version with each indexed item. Choose how group membership and document permissions are resolved at query time. If the source can change permissions independently, design an update and reconciliation path rather than assuming the first ingestion remains correct forever.

Microsoft's Azure AI Search documentation describes document-level access-control approaches. Supported features and availability vary, so check the selected implementation's current requirements. The architectural requirement remains the same: the application must reliably restrict retrieved material to what the caller may access.

Reference: Azure AI Search document-level access overview

Filter before private material reaches the model

Build retrieval using verified identity and workspace context from the server. Do not accept a browser-provided workspace identifier as sufficient proof. Apply the relevant access constraints before selecting content for generation. Asking the model to ignore unauthorised passages after receiving them is not an access-control mechanism.

Keep the same policy on follow-up queries, tool calls and citations. A citation can leak a document title or URL even when the answer does not quote its contents. Opening that citation should perform an access check instead of trusting that an earlier answer was authorised.

Design caches around the security boundary

A response cache keyed only by question text can return one customer's answer to another. Include the scope and policy context necessary to make reuse safe, or avoid sharing answers across users when you cannot establish equivalence. The same issue applies to conversation history: a new workspace selection must not silently inherit private context from a previous workspace.

Deletion needs a defined lifecycle across source content, chunks, indexes and derived caches. Document the expected completion window and what the system does while removal is pending. Where timely permission updates cannot be guaranteed, consider a current source-authorisation check before releasing sensitive results. Avoid promising immediate deletion without evidence from all those stores.

Evaluate security cases alongside answer quality

Create fictional documents with distinct markers for separate workspaces and roles. Ask direct questions, follow-ups and requests that cite hidden titles. Verify retrieved identifiers and outbound content, not just the model's final wording. Repeat after changing permissions and after deletion. A model refusing in one test does not prove that retrieval was correctly scoped.

Related: RAG versus fine-tuning for healthtech products

The reviewed UltraFit360 code provides examples of account-scoped application tools; that is not a claim that every RAG pattern here is deployed in the product. For a knowledge-assistant project, AptixLabs can scope the source inventory, access model and negative evaluation cases before adding a conversational interface. Start with the documents and permission changes the first customer will actually use.