Topic starter
12/06/2026 12:39 am
TL;DR: Retrieval-augmented generation can surface unauthorized material when vector search is not constrained by identity and document-level permissions, according to Lasso Security. The practical issue is not hallucination alone but who can retrieve what, which makes access control and context filtering central to enterprise AI governance.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “Riding the RAG Trail: Access, Permissions and Context”.
Key questions
Q: What breaks when RAG is connected to content without permission filtering?
A: The retrieval layer can return material the user was never intended to see, because similarity search is not the same thing as authorisation.
Q: Why do RAG systems create a governance issue even when hallucinations improve?
A: Because the main risk shifts from answer quality to access scope.
Q: How should security teams decide between separate RAG instances and document-level filtering?
A: Use separate instances when segregation is the only reliable way to keep sensitive populations apart, but prefer document-level filtering when you need one knowledge base with fine-grained entitlements.
Practitioner guidance
- Audit retrieval paths for hidden access bypasses Map where RAG queries are allowed to search and compare that path against the permissions model used by the source documents.
- Attach entitlement metadata to indexed content Require document-level metadata for role, user, or sensitivity before content enters the vector index, and validate that the filter is enforced at query time rather than only at ingestion.
- Test the effect of broad shared-drive permissions Look for files with inherited or permissive access that become newly discoverable through RAG, because conversational retrieval can expose them even when the file location was obscure.
Bottom line: RAG changes the security question from whether a model hallucinates to whether it is allowed to retrieve the material it uses.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
12/06/2026 10:03 am
RAG turns retrieval into an authorisation problem, not just a relevance problem. The article’s core insight is that the user is not only asking for information but entering an access path to indexed data. Once retrieval is driven by vector similarity, the system can surface material that was never meant to be discoverable through that interface. Practitioners should treat retrieval design as an identity governance decision, not an LLM tuning exercise.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How can teams tell whether context-based access control is actually working?
A: Look for consistent denial of access from unmanaged devices, off-policy locations, and unsupported session times, while approved sessions continue to work without manual exception handling. If risky requests still succeed or every exception needs manual review, the control is not operating as a real decision layer.
👉 Read our full editorial: RAG access control gaps expose a new identity governance problem
This post was modified 23 hours ago by NHI Mgmt Group