AI Security Atlas › All entries › RAG & Knowledge Retrieval Security
Missing Document ACLs
Source documents lack enforceable ownership metadata propagated into the retrieval and citation path.
Open in the interactive atlas →Impact
Access decisions cannot be evaluated consistently across ingest, retrieve, and answer stages.
Why this severity
Impact High × Likelihood Medium = High
Impact high: access cannot be enforced downstream. Likelihood medium: many sources carry ACLs that pipelines drop, but exploitation is rarely reported separately.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Related
Exploited by
- Unauthorized Document Exfiltration Threat · High severity
Mitigated by
- Document-Level Access Enforcement Guardrail · Fixes high risks
Remediation
- Require ACL metadata at ingest; reject documents without owners.
- Propagate ACL tags onto every chunk and citation.
- Re-evaluate ACLs on answer rendering, not only on search.
How to verify
- Ingest pipeline rejects ACL-less fixtures.
- Citation renderer drops links the caller cannot open.
Pattern
if (!doc.acl?.owners?.length) throw new IngestError('acl-required');Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM02:2025 Sensitive Information Disclosure
- LLM08:2025 Vector and Embedding Weaknesses
MITRE ATLAS
- AML.T0057 LLM Data Leakage
NIST AI RMF 1.0
- MEASURE 2.10 Privacy risk of the AI system is examined and documented