How do you enforce access control in a RAG system?

The rule I follow is that the model should only ever see text the user is allowed to read. So access control belongs in retrieval, not in the prompt. At ingestion I copy the source system's permissions onto each chunk: tenant ID, allowed users or groups, and a sensitivity label.

At query time the application resolves the user's identity and groups and passes them as a filter inside the vector or keyword search, so forbidden chunks are never candidates. Post-filtering after retrieval is weaker, because it can return too few results, and asking the model not to reveal certain documents is not a control at all, since prompt injection or a clever question can extract them.

The hard part is keeping permissions current. When someone loses access to a folder in the source system, the index has to reflect that quickly, so I sync ACL changes separately from content changes. Any cache of answers or retrieved chunks must be keyed by user or permission set. Finally I test with pairs of users, one who should see a document and one who should not, and I log retrieved chunk IDs for audits.