Similarity is not permission
A retrieval system answers which passages resemble a question. It does not automatically answer whether the person asking may read those passages. A useful RAG assistant needs both decisions, and they should not be delegated to the same mechanism.
Consider two customers who upload almost identical contracts. The wording may be highly similar, but the permission boundary is absolute. A similarity score is irrelevant if the matching document belongs to the wrong customer.
Carry ownership through ingestion
A document's ownership information should survive every transformation. Extracted text, chunks, embeddings and citations need a reliable connection to the original document and its access rules.
An ingestion record can carry a tenant identifier, document identifier and access version. The exact fields depend on the product, but the principle is simple: a chunk should never become an anonymous piece of text that the search layer cannot classify.
Deletion matters too. Removing a document from the main database while retaining searchable chunks creates an inconsistent system. Design deletion and permission changes alongside ingestion, rather than after the first demo.
Enforce access before generation
Resolve the signed-in user's identity on the server. Derive the allowed search scope from trusted application data, apply it during retrieval, and validate selected records before constructing the model context.
The user should not be able to widen that scope by supplying a different tenant identifier in the request. The model should not receive unauthorized text and then be instructed to keep it secret. Once private content reaches the context, the application has already crossed its own boundary.
Build an adversarial fixture
A small permission fixture is easy to understand. Create two synthetic tenants with similar documents, a user who belongs to one tenant, and a shared document with explicit access. Ask questions that would be answered better by the forbidden document.
The expected result is either an authorized answer or a clear lack of evidence. Also test a revoked user, a deleted document and an identifier copied from another account. These cases make the access contract visible to the team.
Keep citations honest
A citation should link to an accessible source through the application's normal authorization path. Check access again when the user opens it. Search quality and permission correctness are separate release gates; both need to pass before the assistant becomes trustworthy.