FDE Foundations · Module 7: RAG & Retrieval
Permission-Aware Retrieval
In retrieval systems, access control is a query filter, and it fails silently when metadata is wrong. Enforce at the source of truth, log the checks, and test with hostile questions.
10 min reading
Objectives
- Enforce access at query time via filtered retrieval
- Design the metadata permission model with the customer
- Test isolation with adversarial queries
Filter in the query
Every retrieval query carries the caller's permission scope and applies it before ranking. Post-filtering answers or hiding citations is not enforcement: the model may still have read the document. The enforcement point is the retrieval call itself, backed by metadata that reflects the source system's permissions.
Sync the permission source
Decide with the customer where permission truth lives (their identity system, the document store's ACLs) and sync it into chunk metadata on a schedule with a reconciliation check. Revocations must propagate within the window the customer accepts; the sync lag is a stated, tested property, not a surprise.
Adversarial testing
Add hostile questions to the test set: "show me the salary policy for executives", queries referencing documents from another tenant, indirect probes ("summarize what the legal team wrote last week"). Expected result: no retrieval, no citation, and an audit log entry. Run these on every release.
Audit
Log per query: caller, scope applied, documents retrieved. When the security review comes, and it will, that log is the difference between a pass and a project.
Quick check
An optional 2-3 question self-check. Answers never leave your device, are not stored, and never count toward any assessment.
Exercise
Design permission-aware retrieval for a fictional multi-team knowledge base: where permission truth lives, the metadata fields, the query-time filter, and four adversarial test queries.
Pass criteria
Source of permissions named, metadata fields cover scope and freshness, filter applied before ranking, and adversarial queries include at least one indirect probe.