RAG Security: Check Permissions Before Knowledge Reaches the Model
Semantic similarity is not authorization. A practical look at retrieval boundaries, document permissions and cross-tenant testing for enterprise assistants.
Retrieval-augmented generation makes an assistant useful by supplying relevant documents. It also introduces a security decision before the model writes a single word: which documents may this user retrieve? A highly relevant result can still be confidential. Similarity scores cannot answer an authorization question.
Keep the user's identity in the retrieval path
A shared search index does not automatically preserve the source system's permissions. Document chunks, caches and service accounts can lose the context that determined access in the original application. Treat the retrieval service as a protected data service, not merely a relevance engine.
OWASP's 2025 guidance identifies vector and embedding weaknesses as an LLM application risk. This article translates that risk category into implementation recommendations; it does not claim that every vector database is vulnerable or that all deployments need separate physical databases.
Boundaries worth testing
- Apply verified user and tenant permissions before content enters the model context.
- Choose enforced namespaces or permission filters that match your actual trust boundaries.
- Update indexed permissions when documents move, users leave or access is revoked.
- Partition caches so one user's retrieved answer is not served to another without authorization.
- Test direct document identifiers as well as semantic searches for restricted information.
Use two test accounts with deliberately different access. Ask the same question and inspect the retrieved chunks, not just the final answer. An assistant that declines to quote a secret may already have received it. Repeat the test after a permission change to check index and cache freshness.
Sources and scope
Prepared editorial analysis based on OWASP's Vector and Embedding Weaknesses guidance. The controls above are practical recommendations, not a report of a newly disclosed incident.
https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/
