RAG security fails when a model can retrieve information the user was never authorized to see. Prompt instructions cannot fix a permission mistake that already happened in retrieval.

Filter before semantic search

Every document or chunk should carry tenant, user, group or role metadata. The retrieval layer must apply those constraints before vector similarity results are returned.

Do not ask the model to enforce ACLs

An LLM is not an authorization engine. Access decisions should be deterministic and auditable. Keep permissions synchronized. When a user leaves a team or a document changes visibility, the retrieval index must reflect that change quickly. Stale ACL metadata can create a silent data leak. Reranking needs the same boundary.

Permission filtering should remain in force through hybrid search and reranking. A later stage should never reintroduce candidates removed for authorization reasons. Test adversarially. Create evaluation cases where users ask for known restricted content and verify that no hidden chunk reaches the generation context. Pair this with the release discipline in LLM Evaluation in CI/CD.

Observe denied retrievals

Track authorization filters, stale-index incidents and cross-tenant test failures without logging sensitive content unnecessarily. Make capability boundaries machine-enforceable. Natural-language tool descriptions help the model choose actions, but security requires deterministic enforcement. Define allowed operations, resource scope, argument constraints and required approval in a policy layer that executes before the tool call. This separation prevents a persuasive model output from expanding its own authority. The application can reject an unsafe action even when the model is highly confident. Prefer short-lived access over standing secrets.

Agents often need access for only a small part of a workflow. Issuing scoped credentials that expire automatically reduces the impact of leaks and simplifies offboarding after the task completes. Credential lifetime should match workflow lifetime, and refresh should require the same policy checks as the original grant. Track security-relevant events explicitly. Logs should capture permission denials, privilege changes, approval grants, credential issuance and external side effects. These events are more useful for investigation than storing every token of ordinary model reasoning. Alerts can focus on unusual patterns such as repeated denied actions, cross-resource attempts or operations occurring after expected workflow completion.

Exercise revocation as part of normal testing

Teams should verify that disabling a user, tool or credential prevents queued and retried work from succeeding later. Revocation propagation is a distributed-systems problem and needs the same end-to-end testing as successful access. Separate identity, policy and credential. A robust security model answers three different questions: who is acting, what that identity is allowed to do and which credential proves the permission to the downstream service. Combining these layers into one long-lived token makes auditing and revocation unnecessarily difficult. Keeping them separate allows the application to change policy without reissuing every identity and to issue narrow credentials only when an allowed action is ready to execute. Constrain the arguments, not just the tool name.

Permission to use a tool should not imply permission to use every possible argument. Validate destination, amount, path, environment and other high-impact fields before execution. For sensitive operations, compare the final arguments with the user-approved intent so a later model turn cannot silently widen the action after approval. Bottom line. Secure RAG starts before the model. Permission-aware indexing and deterministic filtering are the foundation of multi-tenant retrieval.

Separate identity, policy and credential

A robust system answers three questions independently: who is acting, what that identity is allowed to do and which credential proves the permission downstream. Combining all three in one broad long-lived token makes auditing and revocation difficult. Separation lets policy change without reissuing every identity and enables narrow credentials only when an approved action is ready to execute.

Validate sensitive arguments. Permission to call a tool should not imply permission for every destination, path or amount. High-impact arguments should be checked against current policy and the user-approved intent before execution.

This protects the action boundary even if the model later changes its plan.

Use time as a security boundary

Approval expiry and ephemeral credentials reduce the window in which stale assumptions can be abused. Long-running workflows should revalidate sensitive operations when resources or context may have changed. Credential refresh should require the same policy checks as the original grant.

Log security-relevant events deliberately. Permission denials, credential issuance, privilege changes and external side effects are more useful for investigation than indiscriminate storage of every model token.

Alerts can focus on repeated denied actions, cross-resource attempts and operations that occur after the expected workflow lifetime.