Document-Level Access Enforcement

Retrieval and citation paths enforce per-document ACLs tied to the authenticated principal.

Impact

Prevents unauthorized document exfiltration through RAG answers.

Why this severity

Guardrails take the highest severity of the risks they mitigate: Unauthorized Document Exfiltration (High), Missing Document ACLs (High), Over-Privileged Retrieval Indexing (High).

Method: OWASP Risk Rating Methodology

Mitigates

Unauthorized Document Exfiltration Threat · High severity
Missing Document ACLs Vulnerability · High severity
Over-Privileged Retrieval Indexing Vulnerability · High severity

Builds on

Pre-Ingestion Scanning Pipeline Guardrail · Fixes critical risks

Needed by

Protect Embeddings as Sensitive Data Guardrail · Fixes medium risks

Remediation

Filter search hits with `canRead(user, doc)` before LLM context assembly.
Bind citations to the same ACL check used for download.
Log denied retrievals for detection analytics.

How to verify

Cross-user retrieval suites return zero unauthorized hits.
Denied events appear in SIEM with doc id and principal.

Pattern

hits = hits.filter(h => acl.canRead(user, h.docId));

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM02:2025 Sensitive Information Disclosure
LLM08:2025 Vector and Embedding Weaknesses

MITRE ATLAS

AML.M0019 Control Access to AI Models and Data in Production

NIST AI RMF 1.0

MEASURE 2.10 Privacy risk of the AI system is examined and documented