RAG-04 · Permission-aware retrieval and security trimming¶
Teams index documents without carrying their permissions, so a RAG assistant can show a user content they could not open in the source system. Permission changes in the source then take hours or days to reach the index with no tested way to force them through.
- Who reads it: GenAI engineers, security engineers and DevOps engineers running RAG over permissioned content
- Outcome: No permission leakage, revocations applied within agreed time
- Pack owner: Yogeshwaran (catalog owner role: RAG Lead)
Master catalog entry¶
- Catalog name: Metadata & Security Trimming Strategy (P1)
- Why it matters: Document-level permission leakage is a client-terminating failure
- What it removes: Solves the hardest RAG requirement once, correctly
- Stack: Azure AI Search filters, Entra ID groups, ACL sync patterns
- Maturity target: Level 2 — patterns validated on SharePoint and file-share sources
Playbooks¶
| ID | Story | Title | Kind | Complexity | Urgency | Status | Owner | Planned publish |
|---|---|---|---|---|---|---|---|---|
| PB-RAG-04-01 | RAG-04-S1 | Choose security filters or built-in ACL trimming | Decision guide | High | 3 | draft | Yogeshwaran | 2026-11-30 |
| PB-RAG-04-02 | RAG-04-S2 | Implement security-filter trimming with Entra ID groups | How-to | High | 4 | draft | Yogeshwaran | 2026-11-19 |
| PB-RAG-04-03 | RAG-04-S3 | Apply an urgent permission change or revocation | Runbook | Medium | 5 | draft | Kranthi | 2026-11-06 |
| PB-RAG-04-04 | RAG-04-S4 | Permission leakage test and incident checklist | Checklist | Medium | 5 | draft | Kandiah Chockalingam | 2026-11-05 |