Enterprise RAG security
Enforce access control in the retrieval layer so users only ever retrieve documents they are permitted to see. Prompt instructions cannot secure RAG, if the retriever can reach a document, assume the model can surface it.
Access control belongs in retrieval
Filter what each user can retrieve using role- or attribute-based controls tied to your existing permissions. Security enforced at retrieval is reliable; security asked for in a prompt is not.
The safest enterprise pattern mirrors your existing document permissions into the retriever, so a query can only ever pull passages the user is already entitled to read. This prevents the classic failure where a cleverly worded question extracts a restricted document. It also makes audits straightforward: you can show exactly which documents each role can reach, rather than hoping the model behaved.
Frequently asked questions.
Can I just tell the model not to reveal restricted documents?
No, that is not reliable. If the retriever can fetch a document, a well-phrased prompt can surface it. Enforce permissions at the retrieval layer so restricted content is never fetched in the first place.