RAG cites a document the user cannot access: how do you verify retrieval permissions?

Preserve the leaked passage identifier and verify the actual request identity

A common symptom is an ordinary member receiving a restricted-file summary while the cited link denies access. Save the minimal question and document identifier without copying unnecessary sensitive text. Verify the application’s actual identity rather than the browser login. If a shared backend account can read everything, the application must additionally enforce user-level restrictions.

Trace permission checks through retrieval and caches

Check that the index carries required access identifiers and that a trusted server constructs identity filters. Inspect chunk permission inheritance, citation loading and answer caches to prevent reuse of privileged results by another user. A string filter is not identity authentication; users must not obtain access simply by supplying an arbitrary group ID.

Restrict candidates by authenticated identity on the server

Use platform document-level access controls or security trimming built on established authentication, applying it consistently to every retrieval path. Exclude restricted records when authorization information is missing and separate caches by identity and access scope. Verify with synthetic material first. Do not expand account privileges or disable filtering to make the current query appear functional.

Cross-check with two differently authorized test identities

Create two test identities with different allowed material and inspect passages and answers for the same question. An authorized identity should cite normally; an unauthorized one must not receive summaries, titles or sensitive metadata. Test caches after revocation as well. Success means results track actual authorization; an inaccessible link does not establish that its content was never disclosed.

This article accessed no restricted documents and changed no real permissions. Identity, source content and index updates affect authorization, and platform capabilities must be verified. A prompt saying “do not leak” cannot replace server-side access control. Handle actual disclosures through the established incident process rather than merely deleting links from answers.