# Enterprise RAG: architecture, access control and evaluation

> Design traceable RAG with ingestion, revisions, authorisation, retrieval, context and citations. A security example and reproducible offline demonstration.

Published: 2026-11-04  
Canonical: https://rootzero.eu/en/research/enterprise-rag-architecture-access-evaluation/

Retrieval-augmented generation finds external information and supplies it to a model preparing an answer. In an enterprise service, that information must apply to the person, date and question concerned. A fluent answer may cite a genuine procedure belonging to another customer or a withdrawn revision.

The [original RAG paper](https://arxiv.org/abs/2005.11401) combines generation with external document memory. Implementations now vary. Here we propose a controlled pipeline for a security-documentation assistant, illustrated with fictional data and runnable code.

## Define the answer contract

An MSP asking about a VPN maintenance window needs the organisation, asset and date. The application should clarify missing scope or abstain. An index cannot establish an identity that the surrounding application has not authenticated.

Define permitted sources, freshness, citations and possible actions. A documentation assistant does not need permission to change the VPN configuration. Information access and authority to act are separate decisions.

```text
approved source -> extraction -> chunks with provenance and permissions
server identity -> authorised scope -> retrieval -> reranking
selected evidence -> context -> generation -> citation checks
```

Preserve source identity, revision, owner and permissions when splitting documents. Embeddings do not grant additional rights. At query time, derive scope from application identity. Exclude forbidden passages before sending them to a model or external reranker; filtering the final answer cannot undo an earlier disclosure.

## Track derivatives and revocations

A withdrawn procedure may survive in an index, summary or cache. Link these derivatives to their sources and define whether a request needs current information or an authorised historical view.

A cache key consisting only of question text is insufficient for a shared service. Our proposed design includes the access scope, document revision and retrieval settings that affect the answer. Revocation must invalidate affected results: previously calculated answers cannot preserve expired permissions.

## Run the offline example

Download the [demonstration archive](/lab/rag-demo/rag-demo.zip), extract its files together and run:

```sh
python rag_demo.py
```

It applies permissions and validity checks before simple lexical ranking. Ten cases distinguish current and superseded revisions, organisations, roles and missing access metadata. The [recorded output](/lab/rag-demo/results.json) includes expected and actual document IDs and the fixture hash.

These are deterministic selection checks. They do not assess vector retrieval, generated answers or model resistance to prompt injection. Fixture identities are not an authentication mechanism.

## Diagnose stages separately

| Stage | Question | Evidence |
| --- | --- | --- |
| Permissions | Was forbidden material transmitted? | Access decision and source identity |
| Retrieval | Was expected evidence among candidates? | Document IDs and ranks |
| Context | Did the correct revision reach the model? | Selected references and context version |
| Answer | Does each claim have support? | Claim, citation and passage |
| Abstention | Was missing information recognised? | Reason and useful follow-up question |

A valid citation supports the associated claim rather than merely discussing a similar topic. For security procedures, retain dates and applicability conditions. Continue with [hybrid retrieval](/en/research/rag-hybrid-search-chunking-reranking/) and [RAG security](/en/research/rag-security-injection-memory/) in the [AI and security series](/en/ai-security-guides/).