24/09 edition: revoke document access in RAG as well

Access does not end at the original file

An SME creates an internal assistant for consulting project documentation. Sales loses access to a restricted dossier, but the assistant has already indexed it. This edition asks what must be demonstrated before stating that the restriction also applies to generated answers.

Our proposal separates three operations: authorising ingestion, deciding which passages an identity may retrieve and deleting copies when deletion is decided. They are not synonyms. Removing a user from a document does not itself prove that every derived representation has become inaccessible.

The risk identified by OWASP

OWASP LLM08 identifies unauthorised access from misaligned controls in vector and embedding systems and recommends permission-aware retrieval. LLM02 recommends access limited to what is needed. NIST's AI RMF is voluntary. These sources do not establish the security of a particular vector store.

Owned ingestion, identified retrieval

In our design, whoever approves a dossier for ingestion identifies its owner, scope and access-rule version. The RAG team preserves links between documents, passages and derived objects. If the rule cannot be represented verifiably, the document stays outside the pilot.

Queries use the questioner's identity and an authorisation decision independent of the model's answer. We do not propose retrieving everything and asking the assistant to omit restricted material. The trial must show which candidates were excluded before context construction and why, without dumping confidential content into logs.

The revocation trial

Hypothetical scenario: two authorised identities consult a synthetic document. One loses access; the other retains it. They then repeat the same question and a paraphrase. The expected outcome blocks retrieval for the first without wrongly removing access for the second.

Also test a conversation begun before revocation and a cached answer. Define beforehand whether the service invalidates that state or requires a fresh query. Observe the actual path, not merely the source permission list. A restricted fragment in the revoked identity's context should block expansion even if the final answer conceals it.

Three operations, three evidence owners

The matrix is an untested proposal. The document owner should not have to interpret vector structure alone; engineering should not invent access policy. A deletion decision states what will be removed and what requires separate handling, including logs and recovery copies.

Delete without promising beyond the evidence

We propose inventorying the source document, passages, indexes, caches and stored answers before deletion. For each component, record the action, outcome and exception. A recovery copy still retained should appear as an explicit limitation, with restricted access and a rule for any restoration.

We do not call this proof of compliance with a legal erasure obligation. It is an operating dossier allowing a Portuguese SME to know where content remains and who may consult it. Review the trial when identity, caching or permission synchronisation changes. Describe as observed only what the tests and inventory actually show.