Enterprise RAG: architecture, access control and evaluation

Retrieval-augmented generation finds external information and supplies it to a model preparing an answer. In an enterprise service, that information must apply to the person, date and question concerned. A fluent answer may cite a genuine procedure belonging to another customer or a withdrawn revision.

The original RAG paper combines generation with external document memory. Implementations now vary. Here we propose a controlled pipeline for a security-documentation assistant, illustrated with fictional data and runnable code.

Define the answer contract

An MSP asking about a VPN maintenance window needs the organisation, asset and date. The application should clarify missing scope or abstain. An index cannot establish an identity that the surrounding application has not authenticated.

Define permitted sources, freshness, citations and possible actions. A documentation assistant does not need permission to change the VPN configuration. Information access and authority to act are separate decisions.

approved source -> extraction -> chunks with provenance and permissions
server identity -> authorised scope -> retrieval -> reranking
selected evidence -> context -> generation -> citation checks

Preserve source identity, revision, owner and permissions when splitting documents. Embeddings do not grant additional rights. At query time, derive scope from application identity. Exclude forbidden passages before sending them to a model or external reranker; filtering the final answer cannot undo an earlier disclosure.

Track derivatives and revocations

A withdrawn procedure may survive in an index, summary or cache. Link these derivatives to their sources and define whether a request needs current information or an authorised historical view.

A cache key consisting only of question text is insufficient for a shared service. Our proposed design includes the access scope, document revision and retrieval settings that affect the answer. Revocation must invalidate affected results: previously calculated answers cannot preserve expired permissions.

Run the offline example

Download the demonstration archive, extract its files together and run:

python rag_demo.py

It applies permissions and validity checks before simple lexical ranking. Ten cases distinguish current and superseded revisions, organisations, roles and missing access metadata. The recorded output includes expected and actual document IDs and the fixture hash.

These are deterministic selection checks. They do not assess vector retrieval, generated answers or model resistance to prompt injection. Fixture identities are not an authentication mechanism.

Diagnose stages separately

Stage	Question	Evidence
Permissions	Was forbidden material transmitted?	Access decision and source identity
Retrieval	Was expected evidence among candidates?	Document IDs and ranks
Context	Did the correct revision reach the model?	Selected references and context version
Answer	Does each claim have support?	Claim, citation and passage
Abstention	Was missing information recognised?	Reason and useful follow-up question

A valid citation supports the associated claim rather than merely discussing a similar topic. For security procedures, retain dates and applicability conditions. Continue with hybrid retrieval and RAG security in the AI and security series.