Access-Control-Preserving Retrieval for Enterprise Retrieval-Augmented Generation
DOI:
https://doi.org/10.63282/3117-5481/AIJCST-V7I6P115Keywords:
Retrieval-Augmented Generation, Access Control, Filtered Vector Search, Approximate Nearest Neighbor Search, Data Leakage, Enterprise SearchAbstract
Enterprise retrieval-augmented generation (RAG) assistants index documents that different employees are permitted to read, and a single retrieval of an unauthorized chunk places restricted content in the model's context. We study how to carry source access-control lists (ACLs) into chunk metadata and enforce them at query time, and we measure leakage and recall loss across four index designs: no filtering, post-filtering with oversampling, predicate filtering inside a hierarchical navigable small world (HNSW) graph, and partitioning by ACL signature. We build a synthetic ACL layer of 200 groups in a two-level hierarchy over the public FiQA-2018 corpus and vary caller selectivity from 50% to 1% of the corpus. Unfiltered retrieval placed at least one unauthorized chunk in the top ten for 96% or more of queries at every selectivity. All three filtered designs had zero leakage when ACLs were current, but they differed in recall: at 1% selectivity, filtered recall@10 was 0.24 for post-filtering with 16× oversampling, 0.71 for in-graph filtering, and 1.00 for signature partitions. Partitioning has two costs. Ad hoc document sharing raised fan-out from 4 to 27 partitions per query and p95 search latency from 1.9 ms to 13.5 ms, and after an ACL revocation, partitions without a query-time tombstone check returned revoked chunks for 41% of affected queries until the next rebuild. We recommend in-graph filtering with an exact-search fallback as the default, signature partitioning only where sharing is structured, and enforcement that reads current ACL state at query time in every design.
References
[1] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel, S. Riedel, and D. Kiela, "Retrieval-augmented generation for knowledge-intensive NLP tasks," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 33, 2020, pp. 9459–9474.
[2] S. Zeng, J. Zhang, P. He, Y. Xing, Y. Liu, H. Xu, J. Ren, S. Wang, D. Yin, Y. Chang, and J. Tang, "The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG)," in Findings Assoc. Comput. Linguist. ACL 2024, Bangkok, Thailand, 2024, pp. 4505–4524.
[3] J. X. Morris, V. Kuleshov, V. Shmatikov, and A. M. Rush, "Text embeddings reveal (almost) as much as text," in Proc. Conf. Empirical Methods Natural Lang. Process. (EMNLP), 2023, pp. 12448–12460.
[4] OWASP Foundation, "OWASP Top 10 for LLM Applications 2025," Nov. 2024. [Online]. Available: https://genai.owasp.org/
[5] R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman, "Role-based access control models," Computer, vol. 29, no. 2, pp. 38–47, Feb. 1996.
[6] V. C. Hu, D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone, "Guide to attribute based access control (ABAC) definition and considerations," NIST Special Publication 800-162, Jan. 2014.
[7] Y. A. Malkov and D. A. Yashunin, "Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs," IEEE Trans. Pattern Anal. Mach. Intell., vol. 42, no. 4, pp. 824–836, Apr. 2020.
[8] J. Wang, X. Yi, R. Guo, H. Jin, P. Xu, S. Li, X. Wang, X. Guo, C. Li, X. Xu, K. Yu, Y. Yuan, Y. Zou, J. Long, Y. Cai, Z. Li, Z. Zhang, Y. Mo, J. Gu, R. Jiang, Y. Wei, and C. Xie, "Milvus: A purpose-built vector data management system," in Proc. ACM SIGMOD Int. Conf. Manag. Data, 2021, pp. 2614–2627.
[9] S. Gollapudi, N. Karia, V. Sivashankar, R. Krishnaswamy, N. Begwani, S. Raz, Y. Lin, Y. Zhang, N. Mahapatro, P. Srinivasan, A. Singh, and H. V. Simhadri, "Filtered-DiskANN: Graph algorithms for approximate nearest neighbor search with filters," in Proc. ACM Web Conf. (WWW), 2023, pp. 3406–3416.
[10] L. Patel, P. Kraft, C. Guestrin, and M. Zaharia, "ACORN: Performant and predicate-agnostic search over vector embeddings and structured data," Proc. ACM Manag. Data (SIGMOD), vol. 2, no. 3, 2024.
[11] M. Douze, A. Guzhva, C. Deng, J. Johnson, G. Szilvasy, P.-E. Mazaré, M. Lomeli, L. Hosseini, and H. Jégou, "The Faiss library," arXiv:2401.08281, 2024.
[12] J. Johnson, M. Douze, and H. Jégou, "Billion-scale similarity search with GPUs," IEEE Trans. Big Data, vol. 7, no. 3, pp. 535–547, Jul. 2021.
[13] Microsoft, "Security filters for trimming results in Azure AI Search," Microsoft Learn. [Online]. Available: https://learn.microsoft.com/azure/search/search-security-trimming-for-azure-search.
[14] Microsoft, "Configure group claims for applications by using Microsoft Entra ID," Microsoft Learn. [Online]. Available: https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-fed-group-claims.
[15] N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych, "BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models," in Proc. NeurIPS Datasets Benchmarks Track, 2021.
[16] M. Maia, S. Handschuh, A. Freitas, B. Davis, R. McDermott, M. Zarrouk, and A. Balahur, "WWW'18 open challenge: Financial opinion mining and question answering," in Companion Proc. Web Conf. (WWW), 2018, pp. 1941–1942.
[17] S. Xiao, Z. Liu, P. Zhang, N. Muennighoff, D. Lian, and J.-Y. Nie, "C-Pack: Packed resources for general Chinese embeddings," in Proc. 47th Int. ACM SIGIR Conf. Res. Develop. Inf. Retrieval, 2024, pp. 641–649.
