Skip to main content
Style:
Size:

Chapter 9: Feeding the Machine (Securing RAG and Corporate Data)

If you buy an off-the-shelf Large Language Model (LLM) and ask it to summarize your company’s Q3 financial strategy, it will fail. It doesn't know your strategy. It only knows the public internet data it was trained on.

To make AI useful for the enterprise, companies use a technique called Retrieval-Augmented Generation (RAG).

RAG acts like an incredibly fast research assistant. When an employee asks the AI a question, the system searches your internal corporate documents, finds the relevant paragraphs, hands those paragraphs to the LLM, and says: "Read this internal data, and use it to answer the user's question."

This is a brilliant capability, but from an Identity and Access Management perspective, it introduces a terrifying data privacy nightmare.

The RAG Identity Crisis​

In a traditional file system (like SharePoint or Google Drive), Role-Based Access Control (RBAC) works perfectly.

  • Alice is in HR. She can see the Payroll.pdf file.
  • Bob is an Intern. The file system completely hides Payroll.pdf from him.

But in a RAG system, your corporate documents are ingested, shredded into chunks of text, converted into numbers, and stored in a Vector Database.

  • The Flaw: Many early Vector Databases were built by data scientists, not security engineers. They stripped away all the IAM permissions during the ingestion process.
  • The Impact: If Bob the Intern asks the corporate AI chatbot, "What is the CEO's salary?", the RAG system searches the Vector Database, finds the chunks of text that originated from the Payroll.pdf file, feeds them to the LLM, and happily tells Bob the CEO makes $2 million a year.

The AI just bypassed your entire HR security perimeter because the data lost its identity context.

The Solution: Entitlement Propagation​

To secure a RAG pipeline, the identity of the human asking the question must travel all the way down to the Vector Database. This is called Entitlement Propagation.

When a document is ingested into the AI system, its metadata (its IAM access rules) must be ingested alongside it.

  1. The Question: Bob asks, "What is the CEO's salary?"
  2. The Identity Check: The AI system checks Bob's identity token (He is an Intern).
  3. The Filtered Search: The system queries the Vector Database, but applies a strict filter: "Only return data chunks where Role = Intern or Role = Public."
  4. The Result: The database ignores the HR documents entirely. The LLM replies: "I'm sorry, I don't have access to that information."

Visual Logic: A Secure Enterprise RAG Pipeline​

The 5 Pillars of RAG Security​

Let's apply our framework to securing an internal AI knowledge base.

  1. People: Data Owners (the executives or managers who own the original documents) are responsible for classifying their data before it gets ingested into the AI.
  2. Process: Data cannot be ingested blindly. The pipeline must map existing Active Directory (AD) groups to the Vector Database metadata tags.
  3. Technology: Utilize Vector Databases that natively support Document-Level Security (DLS) and robust metadata filtering.
  4. Control: The user's OAuth token (or JWT) must be passed downstream to the retrieval engine to enforce strict identity checks on every single query.
  5. Impact: By ensuring the LLM can only "read" what the human user is already permitted to read, the blast radius of a data leak is contained entirely to that specific user's existing clearance level.

Interactive Simulator: Entitlement Filter Visualizer​

See how vector database ACL tags and identity tokens dynamically filter knowledge retrieval:

RAG Identity & Entitlement Simulator

See how Document-Level Security (DLS) and Access Control Lists filter RAG vector contexts before inference.

Vector Knowledge Base
Chunks tagged with IAM metadata ACLs:
Public (Level 1)
Our public product roadmap will launch next Tuesday.
Employee (Level 2)
The internal engineering cafeteria is scheduled for weekend maintenance.
Executive (Level 3)
Projected Q4 confidential acquisition target valuation exceeds $40M.
1. Present Authenticated Token
Active Context: Guest (Level 1)
2. Query the Assistant

Consultant's Corner: The "Garbage In, Garbage Out" Warning​

When you are hired to architect IAM for an enterprise AI rollout, you will often find that the client's underlying file permissions are a total disaster.

They will have "Global Share" folders containing accidentally uploaded passwords, unredacted customer data, and legacy HR files. In the past, this was protected by "security through obscurity"—nobody knew the files were there, so nobody looked for them.

AI destroys security through obscurity.

An LLM will instantly find, read, and summarize that forgotten global folder. If you feed garbage permissions into a RAG pipeline, you will build an incredibly efficient, automated data-leak machine. Before you deploy internal AI, you must enforce a massive cleanup of the source data permissions. If the client refuses, make sure they sign off on the risk in writing.