{"id":2961,"date":"2026-06-29T14:59:02","date_gmt":"2026-06-29T05:59:02","guid":{"rendered":"https:\/\/stg.aktsk.ai\/?post_type=blog&p=2961"},"modified":"2026-06-29T15:12:43","modified_gmt":"2026-06-29T06:12:43","slug":"securing-the-retrieval-layer-why-ai-assistants-leak-data-and-how-to-build-access-control-that-holds","status":"publish","type":"blog","link":"https:\/\/stg.aktsk.ai\/en\/blog\/2961\/","title":{"rendered":"Securing the Retrieval Layer: Why AI Assistants Leak Data, and How to Build Access Control That Holds"},"content":{"rendered":"
\n

In<\/span> the<\/span> first<\/span> article<\/span> of<\/span> this<\/span> series<\/span>, we<\/span> listed<\/span> five<\/span> patterns<\/span> that<\/span> cause<\/span> enterprise<\/span> AI<\/span> projects<\/span> to<\/span> fail<\/span>
\n security<\/span> review.<\/span> One<\/span> of<\/span> them<\/span> \u2014 retrieval<\/span> pipelines<\/span> that<\/span> bypass<\/span> existing<\/span> access<\/span> controls<\/span> \u2014 is<\/span> worth<\/span> a deeper<\/span>
\n look<\/span>, because<\/span> it<\/span> is<\/span> the<\/span> pattern<\/span> reviewers<\/span> flag<\/span> most<\/span> often<\/span> and<\/span> the<\/span> one<\/span> teams<\/span> find<\/span> hardest<\/span> to<\/span> retrofit.<\/span><\/p>\n

It<\/span> is<\/span> also<\/span> the<\/span> failure<\/span> that<\/span> does<\/span> the<\/span> most<\/span> damage<\/span> when<\/span> it<\/span> goes<\/span> unnoticed.<\/span> A retrieval<\/span> system<\/span> that<\/span> leaks<\/span> does<\/span>
\n not<\/span> crash<\/span>, does<\/span> not<\/span> raise<\/span> an<\/span> alert<\/span>, and<\/span> does<\/span> not<\/span> leave<\/span> an<\/span> obvious<\/span> trace.<\/span> It<\/span> simply<\/span> answers<\/span> a question<\/span> using<\/span> a
\n document<\/span> the<\/span> person<\/span> asking<\/span> was<\/span> never<\/span> allowed<\/span> to<\/span> see.<\/span><\/p>\n

First<\/span>, the<\/span> plain<\/span> version<\/span> of<\/span> what<\/span> we<\/span> are<\/span> talking<\/span> about.<\/span> Many<\/span> enterprise<\/span> AI<\/span> assistants<\/span> work<\/span> by<\/span> looking<\/span> things<\/span> up<\/span>
\n before<\/span> they<\/span> answer.<\/span> You<\/span> ask<\/span> a question<\/span>, the<\/span> system<\/span> searches<\/span> a library<\/span> of<\/span> the<\/span> company’s<\/span> documents<\/span> for<\/span> the<\/span> most<\/span>
\n relevant<\/span> passages<\/span>, hands<\/span> those<\/span> passages<\/span> to<\/span> the<\/span> AI<\/span> model<\/span>, and<\/span> the<\/span> model<\/span> writes<\/span> its<\/span> answer<\/span> based<\/span> on<\/span> them.<\/span> This<\/span>
\n look-up-then-answer<\/span> design<\/span> is<\/span> known<\/span> as<\/span> retrieval-augmented<\/span> generation<\/span><\/strong>, or<\/span> RAG<\/span>, and<\/span> it<\/span> helps<\/span>
\n reduce<\/span> the<\/span> risk<\/span> of<\/span> the<\/span> assistant<\/span> making<\/span> things<\/span> up<\/span> by<\/span> grounding<\/span> its<\/span> answers<\/span> in<\/span> real<\/span> company<\/span>
\n documents.<\/span> RAG<\/span> reduces<\/span> that<\/span> risk<\/span>; it<\/span> does<\/span> not<\/span> remove<\/span> it<\/span> \u2014 a model<\/span> can<\/span> still<\/span> misread<\/span> the<\/span> passages<\/span> it<\/span> retrieves<\/span>,
\n pull<\/span> back<\/span> the<\/span> wrong<\/span> ones<\/span>, or<\/span> answer<\/span> inaccurately.<\/span> The<\/span>
\n “retrieval<\/span> layer<\/span>” is<\/span> simply<\/span> the<\/span> part<\/span> that<\/span> does<\/span> the<\/span> searching.<\/span> The<\/span> risk<\/span> this<\/span> article<\/span> is<\/span> about<\/span> is<\/span> what<\/span> happens<\/span>
\n when<\/span> that<\/span> search<\/span> reaches<\/span> documents<\/span> the<\/span> person<\/span> asking<\/span> should<\/span> never<\/span> have<\/span> been<\/span> allowed<\/span> to<\/span> open.<\/span><\/p>\n

This<\/span> article<\/span> is<\/span> about<\/span> why<\/span> that<\/span> happens<\/span>, what<\/span> it<\/span> looks<\/span> like<\/span> in<\/span> practice<\/span>, and<\/span> how<\/span> to<\/span> design<\/span> a retrieval<\/span> layer<\/span>
\n that<\/span> holds<\/span> up<\/span> \u2014 explained<\/span> so<\/span> that<\/span> a security<\/span> reviewer<\/span>, an<\/span> engineer<\/span>, and<\/span> a business<\/span> owner<\/span> can<\/span> each<\/span> take<\/span>
\n something<\/span> useful<\/span> from<\/span> it.<\/span><\/p>\n

Three<\/span> concerns<\/span> we<\/span> hear<\/span> when<\/span> this<\/span> comes<\/span> up<\/span> in<\/span> review<\/span>:<\/p>\n

\n
“Our<\/span> access<\/span> controls<\/span> live<\/span> in<\/span> the<\/span> app.<\/span> The<\/span> search<\/span> system<\/span> underneath<\/span> doesn’t<\/span> know<\/span> who’s<\/span> asking.<\/span>“<\/div>\n
“We<\/span> loaded<\/span> everything<\/span> into<\/span> one<\/span> library.<\/span> We<\/span> can’t<\/span> say<\/span>, document<\/span> by<\/span> document<\/span>, who’s<\/span> allowed<\/span> to<\/span> pull<\/span> it<\/span>
\n back.<\/span>“<\/div>\n
“The<\/span> answer<\/span> was<\/span> right.<\/span> The<\/span> problem<\/span> is<\/span> the<\/span> user<\/span> should<\/span> never<\/span> have<\/span> been<\/span> able<\/span> to<\/span> get<\/span> it.<\/span>“<\/div>\n<\/div>\n
\n

How<\/span> the<\/span> Gap<\/span> Opens<\/span><\/h2>\n

Most<\/span> RAG<\/span> systems<\/span> begin<\/span> life<\/span> as<\/span> a prototype<\/span>, and<\/span> prototypes<\/span> are<\/span> built<\/span> to<\/span> prove<\/span> that<\/span> retrieval<\/span> works<\/span> at<\/span> all.<\/span>
\n The<\/span> fastest<\/span> way<\/span> to<\/span> prove<\/span> it<\/span> is<\/span> to<\/span> load<\/span> every<\/span> available<\/span> document<\/span> into<\/span> one<\/span> searchable<\/span> library<\/span> \u2014 in<\/span> technical<\/span>
\n terms<\/span>, a single<\/span> search<\/span> index<\/span> \u2014 and<\/span> let<\/span> the<\/span> assistant<\/span> query<\/span> all<\/span> of<\/span> it<\/span> freely.<\/span> Who<\/span> is<\/span> allowed<\/span> to<\/span> see<\/span> which<\/span>
\n document<\/span> is<\/span> a problem<\/span> for<\/span> later.<\/span><\/p>\n

The<\/span> trouble<\/span> is<\/span> that<\/span> “later<\/span>” rarely<\/span> arrives<\/span> before<\/span> production.<\/span> The<\/span> prototype’s<\/span> architecture<\/span> \u2014 one<\/span> shared<\/span> index<\/span>,
\n queried<\/span> without<\/span> reference<\/span> to<\/span> who<\/span> is<\/span> asking<\/span> \u2014 becomes<\/span> the<\/span> production<\/span> architecture.<\/span> Access<\/span> control<\/span>, if<\/span> it<\/span>
\n exists<\/span>, gets<\/span> bolted<\/span> onto<\/span> the<\/span> chat<\/span> interface<\/span>: the<\/span> application<\/span> decides<\/span> what<\/span> to<\/span> show<\/span><\/em>, after<\/span> retrieval<\/span> has<\/span>
\n already<\/span> decided<\/span> what<\/span> to<\/span> find<\/span><\/em>.<\/p>\n

That<\/span> ordering<\/span> is<\/span> the<\/span> whole<\/span> problem.<\/span> By<\/span> the<\/span> time<\/span> the<\/span> application<\/span> applies<\/span> its<\/span> rules<\/span>, the<\/span> sensitive<\/span> content<\/span> has<\/span>
\n already<\/span> been<\/span> retrieved<\/span>, already<\/span> been<\/span> placed<\/span> in<\/span> the<\/span> model’s<\/span> context<\/span>, and<\/span> already<\/span> shaped<\/span> the<\/span> answer.<\/span> Filtering<\/span>
\n the<\/span> final<\/span> response<\/span> can<\/span> add<\/span> a useful<\/span> layer<\/span> of<\/span> protection<\/span>, but<\/span> it<\/span> should<\/span> never<\/span> be<\/span> relied<\/span> on<\/span> as<\/span> the<\/span> primary<\/span>
\n access-control<\/span> mechanism<\/span> \u2014 by<\/span> that<\/span> point<\/span> you<\/span> are<\/span> hoping<\/span> the<\/span> model<\/span> does<\/span> not<\/span> repeat<\/span> what<\/span> you<\/span> just<\/span> handed<\/span> it.<\/span><\/p>\n

\n

FILTER<\/span> AFTER<\/span> THE<\/span> SEARCH<\/span>  —  LEAKS<\/span><\/p>\n\n\n
User<\/span> asks<\/span><\/strong><\/td>\n→<\/td>\nSearch<\/span><\/strong>
all<\/span> documents<\/span><\/span><\/td>\n		→<\/td>\nModel<\/span><\/strong><\/td>\n→<\/td>\nAnswer<\/span><\/strong><\/td>\n→<\/td>\nFilter<\/span><\/strong>
too<\/span> late<\/span> ✗<\/span><\/td>\n<\/tr>\n<\/table>\n

CHECK<\/span> ACCESS<\/span> BEFORE<\/span> THE<\/span> SEARCH<\/span>  —  HOLDS<\/span><\/p>\n\n\n
User<\/span><\/strong>
+ identity<\/span><\/span><\/td>\n		→<\/td>\nAccess<\/span> check<\/span> ✓<\/strong><\/td>\n→<\/td>\nSearch<\/span><\/strong>
allowed<\/span> only<\/span><\/span><\/td>\n		→<\/td>\nModel<\/span><\/strong><\/td>\n→<\/td>\nAnswer<\/span><\/strong><\/td>\n<\/tr>\n<\/table>\n

The<\/span> same<\/span> pipeline<\/span>, two<\/span> designs.<\/span> Filtering<\/span> after<\/span> the<\/span> search<\/span> leaks<\/span>, because<\/span> the<\/span> restricted<\/span> content<\/span> has<\/span> already<\/span> shaped<\/span> the<\/span> answer.<\/span> Checking<\/span> access<\/span> before<\/span> the<\/span> search<\/span> holds<\/span>, because<\/span> the<\/span> search<\/span> never<\/span> reaches<\/span> it.<\/span><\/p>\n<\/div>\n

A security<\/span> reviewer<\/span> sees<\/span> this<\/span> immediately<\/span> and<\/span> names<\/span> it<\/span> correctly<\/span>: an<\/span> authorization-bypass<\/span> (or<\/span>
\n privilege-escalation<\/span>) risk<\/span><\/strong>. The<\/span> system<\/span> can<\/span> surface<\/span> information<\/span> a user<\/span> has<\/span> no<\/span> clearance<\/span> to<\/span> see<\/span>, with<\/span> no<\/span> record<\/span> that<\/span> it<\/span>
\n happened<\/span>, because<\/span> the<\/span> access<\/span> decision<\/span> was<\/span> made<\/span> at<\/span> a layer<\/span> that<\/span> has<\/span> no<\/span> concept<\/span> of<\/span> user<\/span> identity.<\/span><\/p>\n

What<\/span> Leakage<\/span> Actually<\/span> Looks<\/span> Like<\/span><\/h2>\n

The<\/span> abstract<\/span> risk<\/span> becomes<\/span> concrete<\/span> in<\/span> a handful<\/span> of<\/span> recurring<\/span> failure<\/span> modes.<\/span> Each<\/span> one<\/span> passes<\/span> a demo<\/span> and<\/span> fails<\/span>
\n in<\/span> production.<\/span><\/p>\n

Loading<\/span> too<\/span> much<\/span> into<\/span> one<\/span> library.<\/span><\/strong> Everything<\/span> goes<\/span> into<\/span> a single<\/span> library<\/span> “so<\/span> the<\/span> assistant<\/span>
\n is<\/span> comprehensive<\/span>” \u2014 HR<\/span> records<\/span>, board<\/span> materials<\/span>, salary<\/span> data<\/span>, legal<\/span> drafts<\/span>, customer<\/span> personal<\/span> information.<\/span> The<\/span>
\n model<\/span> is<\/span> now<\/span> one<\/span> well-phrased<\/span> question<\/span> away<\/span> from<\/span> any<\/span> of<\/span> it.<\/span> Comprehensiveness<\/span>, in<\/span> a system<\/span> without<\/span>
\n per-document<\/span> permissions<\/span>, is<\/span> the<\/span> same<\/span> thing<\/span> as<\/span> exposure.<\/span><\/p>\n

Checking<\/span> permissions<\/span> too<\/span> late.<\/span><\/strong> Permissions<\/span> are<\/span> enforced<\/span> in<\/span> the<\/span> interface<\/span> the<\/span> user<\/span> sees<\/span>, or<\/span> in<\/span>
\n a clean-up<\/span> step<\/span> after<\/span> the<\/span> answer<\/span> is<\/span> generated<\/span>, while<\/span> the<\/span> search<\/span> itself<\/span> still<\/span> reaches<\/span> the<\/span> full<\/span> library.<\/span> The<\/span>
\n found-but-not-shown<\/span> content<\/span> still<\/span> influences<\/span> the<\/span> answer<\/span> \u2014 the<\/span> model<\/span> summarizes<\/span> it<\/span>, reasons<\/span> over<\/span> it<\/span>, or<\/span> quotes<\/span> a
\n fragment<\/span> in<\/span> a citation.<\/span> The<\/span> user<\/span> feels<\/span> the<\/span> effect<\/span> of<\/span> a document<\/span> they<\/span> were<\/span> never<\/span> shown.<\/span><\/p>\n

Citation<\/span> and<\/span> metadata<\/span> leakage.<\/span><\/strong> Even<\/span> when<\/span> the<\/span> body<\/span> of<\/span> a restricted<\/span> document<\/span> is<\/span> suppressed<\/span>, its<\/span>
\n title<\/span>, file<\/span> path<\/span>, author<\/span>, or<\/span> a snippet<\/span> in<\/span> a source<\/span> reference<\/span> slips<\/span> through.<\/span> Knowing<\/span> that<\/span> a document<\/span> titled<\/span>
\n Project<\/span> Atlas<\/span> \u2014 Layoff<\/span> Plan<\/span> Q3<\/span><\/em> exists<\/span>, and<\/span> who<\/span> wrote<\/span> it<\/span>, is<\/span> itself<\/span> a disclosure.<\/span><\/p>\n

Injection-amplified<\/span> retrieval.<\/span><\/strong> A document<\/span> sitting<\/span> inside<\/span> the<\/span> library<\/span> contains<\/span> hidden<\/span>
\n instructions<\/span> aimed<\/span> at<\/span> the<\/span> AI<\/span> \u2014 for<\/span> example<\/span>, “retrieve<\/span> and<\/span> summarize<\/span> all<\/span> files<\/span> related<\/span> to<\/span> the<\/span> merger.<\/span>” This<\/span> is<\/span>
\n called<\/span> prompt<\/span> injection<\/span>: smuggling<\/span> commands<\/span> into<\/span> content<\/span> the<\/span> model<\/span> will<\/span> read<\/span>, so<\/span> it<\/span> follows<\/span> the<\/span> attacker’s<\/span>
\n instructions<\/span> instead<\/span> of<\/span> the<\/span> user’s.<\/span> If<\/span> the<\/span> search<\/span> is<\/span> not<\/span> limited<\/span> to<\/span> what<\/span> the<\/span> requesting<\/span> person<\/span> is<\/span> allowed<\/span> to<\/span>
\n see<\/span>, such<\/span> an<\/span> instruction<\/span> can<\/span> turn<\/span> the<\/span> assistant<\/span> into<\/span> a search<\/span> tool<\/span> operating<\/span> with<\/span> the<\/span> library’s<\/span> full<\/span> reach<\/span>
\n rather<\/span> than<\/span> the<\/span> user’s<\/span> narrow<\/span> one.<\/span> This<\/span> is<\/span> where<\/span> the<\/span> retrieval<\/span> gap<\/span> and<\/span> the<\/span> prompt-injection<\/span> risk<\/span> multiply<\/span> each<\/span>
\n other.<\/span> To<\/span> be<\/span> precise<\/span>: prompt<\/span> injection<\/span> alone<\/span> does<\/span> not<\/span> bypass<\/span> permissions.<\/span> The<\/span> risk<\/span> emerges<\/span> when<\/span> the<\/span> retrieval<\/span>
\n system<\/span> executes<\/span> the<\/span> model’s<\/span> instructions<\/span> without<\/span> independently<\/span> enforcing<\/span> access<\/span> controls<\/span> of<\/span> its<\/span> own.<\/span><\/p>\n

The<\/span> common<\/span> thread<\/span>: in<\/span> every<\/span> case<\/span> the<\/span> access<\/span> decision<\/span> happens<\/span> too<\/span> late<\/span>, at<\/span> a layer<\/span> that<\/span> does<\/span> not<\/span> know<\/span> who<\/span> is<\/span>
\n asking.<\/span><\/p>\n

The<\/span> Principle<\/span>: Retrieval<\/span> Is<\/span> a Privileged<\/span> Subsystem<\/span><\/h2>\n

The<\/span> fix<\/span> is<\/span> a shift<\/span> in<\/span> where<\/span> the<\/span> trust<\/span> boundary<\/span> sits.<\/span> The<\/span> retrieval<\/span> layer<\/span> is<\/span> not<\/span> plumbing<\/span> that<\/span> feeds<\/span> the<\/span> model.<\/span>
\n It<\/span> is<\/span> a privileged<\/span> subsystem<\/span> that<\/span> must<\/span> enforce<\/span> the<\/span> same<\/span> access<\/span> rules<\/span> as<\/span> any<\/span> other<\/span> system<\/span> touching<\/span> sensitive<\/span>
\n data<\/span> \u2014 and<\/span> it<\/span> must<\/span> enforce<\/span> them<\/span> at<\/span> retrieval<\/span> time<\/span><\/strong>, before<\/span> content<\/span> ever<\/span> reaches<\/span> the<\/span> model’s<\/span>
\n context.<\/span><\/p>\n

Stated<\/span> as<\/span> a single<\/span> rule<\/span>: a user’s<\/span> query<\/span> should<\/span> only<\/span> ever<\/span> be<\/span> able<\/span> to<\/span> retrieve<\/span> documents<\/span> that<\/span> same<\/span> user<\/span> is<\/span>
\n authorized<\/span> to<\/span> read<\/span> directly.<\/span><\/em> If<\/span> they<\/span> could<\/span> not<\/span> open<\/span> the<\/span> file<\/span> in<\/span> the<\/span> document<\/span> management<\/span> system<\/span>, the<\/span>
\n assistant<\/span> must<\/span> not<\/span> be<\/span> able<\/span> to<\/span> retrieve<\/span> it<\/span> on<\/span> their<\/span> behalf.<\/span><\/p>\n

Everything<\/span> below<\/span> is<\/span> in<\/span> service<\/span> of<\/span> that<\/span> one<\/span> rule.<\/span><\/p>\n

Designing<\/span> Access<\/span> Control<\/span> That<\/span> Holds<\/span><\/h2>\n

▪<\/span> Tag<\/span> every<\/span> document<\/span> with<\/span> who<\/span> is<\/span> allowed<\/span> to<\/span> see<\/span> it.<\/span><\/strong> To<\/span> make<\/span> searching<\/span> efficient<\/span>, systems<\/span>
\n break<\/span> documents<\/span> into<\/span> smaller<\/span> passages.<\/span> Each<\/span> of<\/span> those<\/span> passages<\/span> should<\/span> carry<\/span> the<\/span> same<\/span> access<\/span> information<\/span> as<\/span> its<\/span>
\n source<\/span> file<\/span> \u2014 its<\/span> owner<\/span>, its<\/span> sensitivity<\/span> level<\/span>, and<\/span> which<\/span> teams<\/span> or<\/span> roles<\/span> may<\/span> read<\/span> it.<\/span> The<\/span> permissions<\/span> travel<\/span>
\n with<\/span><\/em> the<\/span> content<\/span> into<\/span> the<\/span> search<\/span> library<\/span>, rather<\/span> than<\/span> being<\/span> remembered<\/span> somewhere<\/span> off<\/span> to<\/span> the<\/span> side.<\/span><\/p>\n

▪<\/span> Apply<\/span> those<\/span> permissions<\/span> at<\/span> the<\/span> moment<\/span> of<\/span> the<\/span> search<\/span>, tied<\/span> to<\/span> who<\/span> is<\/span> asking.<\/span><\/strong> Every<\/span> search<\/span>
\n should<\/span> know<\/span> the<\/span> identity<\/span> of<\/span> the<\/span> person<\/span> making<\/span> the<\/span> request<\/span> and<\/span> only<\/span> return<\/span> passages<\/span> that<\/span> person<\/span> is<\/span> cleared<\/span> to<\/span>
\n read.<\/span> In<\/span> practice<\/span> this<\/span> means<\/span> the<\/span> system<\/span> filters<\/span> by<\/span> permission<\/span> before<\/span><\/em> it<\/span> goes<\/span> looking<\/span>, so<\/span> a
\n restricted<\/span> passage<\/span> is<\/span> never<\/span> even<\/span> a candidate.<\/span> Screening<\/span> out<\/span> forbidden<\/span> material<\/span> before<\/span> the<\/span> search<\/span> is<\/span> both<\/span>
\n safer<\/span> and<\/span> faster<\/span> than<\/span> trying<\/span> to<\/span> scrub<\/span> it<\/span> from<\/span> the<\/span> answer<\/span> afterward.<\/span><\/p>\n

▪<\/span> Keep<\/span> the<\/span> most<\/span> sensitive<\/span> data<\/span> in<\/span> its<\/span> own<\/span> space<\/span>, not<\/span> just<\/span> behind<\/span> a label.<\/span><\/strong> Where<\/span> the<\/span> gap<\/span> in<\/span>
\n sensitivity<\/span> is<\/span> large<\/span> \u2014 different<\/span> clients<\/span>, different<\/span> departments<\/span>, confidential<\/span> versus<\/span> public<\/span> \u2014 logical<\/span> or<\/span>
\n physical<\/span> separation<\/span> may<\/span> be<\/span> appropriate<\/span> depending<\/span> on<\/span> the<\/span> sensitivity<\/span> and<\/span> risk<\/span> profile<\/span>: a dedicated<\/span> index<\/span>,
\n collection<\/span>, namespace<\/span>, or<\/span> tenant<\/span>, rather<\/span> than<\/span> a label<\/span> on<\/span> one<\/span> shared<\/span> library.<\/span> A label<\/span> is<\/span> a rule<\/span> that<\/span> can<\/span> be<\/span>
\n misconfigured<\/span>; a separate<\/span> store<\/span> is<\/span> a boundary<\/span> that<\/span> has<\/span> to<\/span> be<\/span> deliberately<\/span> crossed.<\/span><\/p>\n

▪<\/span> Keep<\/span> permissions<\/span> current<\/span> as<\/span> they<\/span> change.<\/span><\/strong> Access<\/span> rights<\/span> are<\/span> not<\/span> static<\/span>: people<\/span> change<\/span>
\n teams<\/span>, documents<\/span> get<\/span> reclassified<\/span>, files<\/span> are<\/span> deleted.<\/span> If<\/span> the<\/span> search<\/span> library<\/span> is<\/span> filled<\/span> once<\/span> and<\/span> never<\/span>
\n updated<\/span>, it<\/span> quietly<\/span> preserves<\/span> an<\/span> old<\/span> snapshot<\/span> of<\/span> who<\/span> could<\/span> see<\/span> what<\/span>, drifting<\/span> further<\/span> from<\/span> reality<\/span> every<\/span> day.<\/span>
\n Updating<\/span> and<\/span> revoking<\/span> access<\/span> has<\/span> to<\/span> be<\/span> an<\/span> ongoing<\/span> process<\/span>, not<\/span> a one-time<\/span> setup<\/span> step.<\/span><\/p>\n

▪<\/span> Hide<\/span> restricted<\/span> material<\/span> everywhere<\/span>, including<\/span> the<\/span> fine<\/span> print.<\/span><\/strong> It<\/span> is<\/span> not<\/span> enough<\/span> to<\/span> keep<\/span> a
\n forbidden<\/span> document<\/span> out<\/span> of<\/span> the<\/span> answer<\/span> itself.<\/span> Its<\/span> title<\/span>, its<\/span> file<\/span> path<\/span>, the<\/span> author’s<\/span> name<\/span>, a snippet<\/span> shown<\/span> in<\/span>
\n a source<\/span> citation<\/span> \u2014 all<\/span> of<\/span> these<\/span> are<\/span> disclosures<\/span> too.<\/span> A document<\/span> the<\/span> user<\/span> cannot<\/span> read<\/span> should<\/span> be<\/span> invisible<\/span> in<\/span>
\n every<\/span> form<\/span> the<\/span> assistant<\/span> can<\/span> produce.<\/span><\/p>\n

▪<\/span> Log<\/span> retrieval<\/span> as<\/span> an<\/span> auditable<\/span> event.<\/span><\/strong> For<\/span> each<\/span> query<\/span>, record<\/span> who<\/span> asked<\/span>, what<\/span> was<\/span> retrieved<\/span>,
\n under<\/span> whose<\/span> permissions<\/span>, and<\/span> at<\/span> what<\/span> time.<\/span> This<\/span> is<\/span> what<\/span> lets<\/span> you<\/span> answer<\/span> the<\/span> reviewer’s<\/span> and<\/span> the<\/span> auditor’s<\/span> core<\/span>
\n question<\/span> after<\/span> the<\/span> fact<\/span> \u2014 who<\/span> could<\/span> have<\/span> seen<\/span> what<\/span>, and<\/span> did<\/span> they<\/span>?<\/em> \u2014 without<\/span> reconstructing<\/span> it<\/span> from<\/span>
\n model<\/span> logs.<\/span><\/p>\n

What<\/span> This<\/span> Maps<\/span> To<\/span> Under<\/span> the<\/span> Rules<\/span><\/h2>\n

These<\/span> are<\/span> not<\/span> only<\/span> engineering<\/span> best<\/span> practices.<\/span> They<\/span> line<\/span> up<\/span> with<\/span> obligations<\/span> under<\/span> the<\/span> EU<\/span> AI<\/span> Act<\/span> and<\/span> with<\/span> the<\/span>
\n recommended<\/span> practices<\/span> set<\/span> out<\/span> in<\/span> Japan’s<\/span> AI<\/span> Guidelines<\/span> for<\/span> Business<\/span> v1.2<\/span>, continuing<\/span> the<\/span> mapping<\/span> from<\/span> the<\/span>
\n opening<\/span> article<\/span> of<\/span> this<\/span> series.<\/span><\/p>\n\n\n\n\n\n\n\n
Control<\/span><\/th>\nEU<\/span> AI<\/span> Act<\/span> (high-risk<\/span> systems<\/span>)<\/th>\nAI<\/span> Guidelines<\/span> for<\/span> Business<\/span> v1.2<\/span><\/th>\n<\/tr>\n<\/thead>\n
Identity-aware<\/span> retrieval<\/span> \/ least<\/span> privilege<\/span><\/td>\nArt.<\/span> 15<\/span> (Accuracy<\/span>, robustness<\/span>, cybersecurity<\/span>)<\/td>\nRecommendations<\/span> regarding<\/span> technical<\/span> robustness<\/span> for<\/span> the<\/span>
\n Provider<\/span> role<\/span><\/td>\n<\/tr>\n
Retrieval<\/span> audit<\/span> logging<\/span><\/td>\nArt.<\/span> 12<\/span> (Record-keeping<\/span>); Art.<\/span> 26<\/span> (Deployer<\/span> log<\/span> retention<\/span>, minimum<\/span> six<\/span> months<\/span>)\n <\/td>\nRecommended<\/span> accountability<\/span> practices<\/span> across<\/span> all<\/span> three<\/span>
\n roles<\/span><\/td>\n<\/tr>\n
Permission<\/span> sync<\/span> and<\/span> data<\/span> governance<\/span><\/td>\nArt.<\/span> 10<\/span> (Data<\/span> and<\/span> data<\/span> governance<\/span>)<\/td>\nRecommended<\/span> transparency<\/span> and<\/span> data-governance<\/span> practices<\/span>
\n for<\/span> Developer<\/span> and<\/span> Provider<\/span> roles<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The<\/span> mapping<\/span> is<\/span> not<\/span> exhaustive<\/span>, but<\/span> the<\/span> direction<\/span> is<\/span> clear.<\/span> A retrieval<\/span> layer<\/span> that<\/span> enforces<\/span> access<\/span> at<\/span> query<\/span>
\n time<\/span> and<\/span> logs<\/span> what<\/span> it<\/span> does<\/span> is<\/span> no<\/span> longer<\/span> just<\/span> good<\/span> hygiene.<\/span> It<\/span> is<\/span> increasingly<\/span> the<\/span> difference<\/span> between<\/span> a system<\/span>
\n that<\/span> clears<\/span> review<\/span> and<\/span> one<\/span> that<\/span> stalls<\/span> in<\/span> it.<\/span><\/p>\n

A Practical<\/span> Order<\/span> of<\/span> Operations<\/span><\/h2>\n

For<\/span> teams<\/span> retrofitting<\/span> an<\/span> existing<\/span> RAG<\/span> system<\/span>, the<\/span> sequence<\/span> that<\/span> tends<\/span> to<\/span> work<\/span>:<\/p>\n

1.<\/span> Take<\/span> inventory.<\/span><\/strong> Know<\/span> exactly<\/span> what<\/span> is<\/span> in<\/span> the<\/span> search<\/span> library<\/span> and<\/span> how<\/span> sensitive<\/span> each<\/span>
\n source<\/span> is.<\/span> You<\/span> cannot<\/span> protect<\/span> what<\/span> you<\/span> have<\/span> not<\/span> catalogued.<\/span><\/p>\n

2.<\/span> Draw<\/span> the<\/span> boundaries.<\/span><\/strong> Decide<\/span> which<\/span> data<\/span> needs<\/span> its<\/span> own<\/span> separate<\/span> room<\/span> \u2014 by<\/span> client<\/span>,
\n department<\/span>, or<\/span> sensitivity<\/span> level<\/span> \u2014 before<\/span> building<\/span> anything.<\/span><\/p>\n

3.<\/span> Move<\/span> the<\/span> access<\/span> check<\/span> to<\/span> the<\/span> moment<\/span> of<\/span> search.<\/span><\/strong> Tag<\/span> each<\/span> passage<\/span> with<\/span> its<\/span> permissions<\/span>
\n and<\/span> limit<\/span> every<\/span> search<\/span> to<\/span> what<\/span> the<\/span> person<\/span> asking<\/span> is<\/span> cleared<\/span> to<\/span> see.<\/span><\/p>\n

4.<\/span> Record<\/span> every<\/span> search.<\/span><\/strong> Keep<\/span> a log<\/span> that<\/span> makes<\/span> each<\/span> look-up<\/span> reconstructable<\/span> after<\/span> the<\/span> fact.<\/span><\/p>\n

5.<\/span> Keep<\/span> access<\/span> current.<\/span><\/strong> Make<\/span> sure<\/span> permission<\/span> changes<\/span> and<\/span> deletions<\/span> flow<\/span> through<\/span> to<\/span> the<\/span>
\n search<\/span> library<\/span> on<\/span> a regular<\/span>, defined<\/span> schedule.<\/span><\/p>\n

None<\/span> of<\/span> this<\/span> is<\/span> exotic<\/span> engineering.<\/span> It<\/span> is<\/span> the<\/span> deliberate<\/span> application<\/span> of<\/span> access-control<\/span> principles<\/span> the<\/span>
\n organization<\/span> already<\/span> uses<\/span> elsewhere<\/span> \u2014 extended<\/span> to<\/span> cover<\/span> a subsystem<\/span> that<\/span>, by<\/span> default<\/span>, was<\/span> built<\/span> to<\/span> ignore<\/span>
\n them.<\/span><\/p>\n

\n

Summary<\/span><\/h2>\n

▪<\/span> The<\/span> retrieval<\/span> layer<\/span> is<\/span> the<\/span> security<\/span> pattern<\/span> reviewers<\/span> flag<\/span> most<\/span>, because<\/span> it<\/span> fails<\/span> silently<\/span>: it<\/span> leaks<\/span> by<\/span>
\n answering<\/span> correctly<\/span> from<\/span> a document<\/span> the<\/span> user<\/span> was<\/span> never<\/span> allowed<\/span> to<\/span> see.<\/span><\/p>\n

▪<\/span> The<\/span> root<\/span> cause<\/span> is<\/span> ordering<\/span> \u2014 access<\/span> control<\/span> bolted<\/span> onto<\/span> the<\/span> application<\/span> after<\/span><\/em> retrieval<\/span> has<\/span>
\n already<\/span> found<\/span> and<\/span> used<\/span> restricted<\/span> content.<\/span><\/p>\n

▪<\/span> Common<\/span> ways<\/span> it<\/span> leaks<\/span>: loading<\/span> too<\/span> much<\/span> into<\/span> one<\/span> library<\/span>, checking<\/span> permissions<\/span> too<\/span> late<\/span>, exposing<\/span> restricted<\/span>
\n titles<\/span> and<\/span> citations<\/span>, and<\/span> hidden<\/span> instructions<\/span> that<\/span> hijack<\/span> the<\/span> search.<\/span><\/p>\n

▪<\/span> The<\/span> fix<\/span> is<\/span> to<\/span> treat<\/span> the<\/span> search<\/span> layer<\/span> as<\/span> a guarded<\/span> system<\/span> and<\/span> check<\/span> access<\/span> at<\/span> the<\/span> moment<\/span> of<\/span>
\n search<\/span><\/strong>: tag<\/span> every<\/span> passage<\/span> with<\/span> who<\/span> may<\/span> see<\/span> it<\/span>, tie<\/span> every<\/span> search<\/span> to<\/span> who<\/span> is<\/span> asking<\/span>, keep<\/span> highly<\/span>
\n sensitive<\/span> data<\/span> in<\/span> separate<\/span> libraries<\/span>, keep<\/span> permissions<\/span> current<\/span>, and<\/span> log<\/span> every<\/span> look-up.<\/span><\/p>\n

▪<\/span> These<\/span> controls<\/span> align<\/span> with<\/span> obligations<\/span> under<\/span> the<\/span> EU<\/span> AI<\/span> Act<\/span> and<\/span> with<\/span> the<\/span> recommendations<\/span> in<\/span> Japan’s<\/span> AI<\/span>
\n Guidelines<\/span> for<\/span> Business<\/span> v1.2<\/span> \u2014 increasingly<\/span> expectations<\/span> for<\/span> enterprise<\/span> AI<\/span> governance<\/span> rather<\/span> than<\/span> optional<\/span>
\n internal<\/span> practices.<\/span><\/p>\n

This<\/span> is<\/span> the<\/span> second<\/span> article<\/span> in<\/span> our<\/span> series<\/span> on<\/span> building<\/span> AI<\/span> systems<\/span> ready<\/span> for<\/span> enterprise<\/span> deployment.<\/span> The<\/span> next<\/span> will<\/span>
\n turn<\/span> to<\/span> prompt<\/span> injection<\/span>: why<\/span> retrieval<\/span> and<\/span> injection<\/span> risks<\/span> compound<\/span> each<\/span> other<\/span>, and<\/span> what<\/span> a layered<\/span> defense<\/span>
\n looks<\/span> like<\/span> in<\/span> production.<\/span><\/p>\n

<\/p>\n

\n

References<\/span><\/p>\n

▪<\/span> European<\/span> Union<\/span>, Regulation<\/span> (EU<\/span>) 2024\/1689<\/span> on<\/span> Artificial<\/span> Intelligence<\/span> (AI<\/span> Act<\/span>)<\/em><\/p>\n

▪<\/span> Ministry<\/span> of<\/span> Economy<\/span>, Trade<\/span> and<\/span> Industry<\/span> & Ministry<\/span> of<\/span> Internal<\/span> Affairs<\/span> and<\/span> Communications<\/span>, AI<\/span>
\n Guidelines<\/span> for<\/span> Business<\/span> v1.2<\/span><\/em> (March<\/span> 2026<\/span>)<\/p>\n

▪<\/span> NIST<\/span>, AI<\/span> Risk<\/span> Management<\/span> Framework<\/span> (AI<\/span> RMF<\/span> 1.0<\/span>)<\/em><\/p>\n

▪<\/span> OWASP<\/span>, Top<\/span> 10<\/span> for<\/span> Large<\/span> Language<\/span> Model<\/span> Applications<\/span><\/em> (esp.<\/span> LLM06<\/span>: Sensitive<\/span> Information<\/span>
\n Disclosure<\/span>)<\/p>\n<\/div>\n<\/div>\n","protected":false},"featured_media":2965,"template":"","blog-cat":[24],"class_list":["post-2961","blog","type-blog","status-publish","has-post-thumbnail","hentry","blog-cat-ai","en-US"],"acf":[],"_links":{"self":[{"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/blog\/2961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/types\/blog"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/media\/2965"}],"wp:attachment":[{"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/media?parent=2961"}],"wp:term":[{"taxonomy":"blog-cat","embeddable":true,"href":"https:\/\/stg.aktsk.ai\/wp-json\/wp\/v2\/blog-cat?post=2961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}