Documents the service can ingest and documents it can use
Retrieval-augmented generation (RAG) finds material related to a question and passes it to the model. Indexing a document and giving a questioner access are separate decisions. A connector may need a service account to read shared drives. The questioner acts with their own identity. That connector’s access must not extend to everyone using search.
A document access control list (ACL) describes who can read a document. When indexing chunks, attach the parent document ID and applicable permission version. Apply the same boundary to names, previews, and attachments. A confidential title alone can reveal a hiring plan or a contract. If the same facts appear in public and restricted sources, record which document was used and its authority to be published.
A search server obtains user identity and memberships from trusted services, then applies an authorized set through search filters or equivalent controls. Map inherited groups and document exceptions, and define what happens when a connector cannot parse permissions. Prevent users from supplying identities or filter values in a prompt. Recheck candidates before they enter model context or become citations as needed.
Microsoft distinguishes generally available string-based security filters in Azure AI Search from preview integrations that ingest native permissions. Its ADLS Gen2 and SharePoint examples cover different sources and synchronization mechanisms. Check the API version, supported source, propagation delay, and authentication on reopened citations for your project. Microsoft Learn — Document-level access control in Azure AI Search[1]
Build an access matrix for questioners and document classes
Suppose a company indexes internal instructions, sales quotes, HR reviews, and a restricted project shared by two departments. Give test accounts representative group memberships and use unique fictional markers in test documents.
| Questioner or account | General instructions | Sales quotes | HR reviews | Restricted joint project |
|---|---|---|---|---|
| Active general employee | Allow | Deny | Deny | Deny |
| Sales employee outside project | Allow | Allow | Deny | Deny |
| HR employee with review and project assignments | Allow | Deny | Allow assigned scope | Allow invitation scope |
| Moved from sales to HR; no review assignment | Allow | Deny | Deny | Deny until assigned |
| Former employee test account | Deny | Deny | Deny | Deny |
| Indexing service account | Ingest configured source | Ingest approved source | Ingest approved source | Ingest approved source |
The last row grants connector access, not conversational access. Membership in HR may not grant access to all reviews. Combine department, project, and individual grants as needed. Test allow and deny cases for guests, expiring accounts, nested groups, privilege elevation, and tenant boundaries that apply to your system. NIST SP 800-207 — Zero Trust Architecture[2]
Someone with multiple roles may retain a valid project grant after a transfer. Make that exception explicit. Broadly blocking sales material can also block a valid joint project. A document moved between folders may retain stale inherited permissions after user transfer tests pass. Test changes to the user and to source-document ACLs separately. See multitenant authorization testing for combinations of objects and actions.
Connect the data each campaign needs — Define events and attributes from campaign needs, then align identifiers, transmission timing and measurement tools.
Follow the paths that can reuse an answer
Answer caches, previous chats, conversation summaries, and file proxies can bypass search. A cache keyed only by the question can give one user another user’s answer. A user or group key can still become stale. Consider disabling caching for sensitive answers or tracking each source and checking current rights before reuse. A cache keyed by group version also needs to handle individual grants and document moves.
Text in old chats and summaries can reach the model without another search. Track source IDs and versions, then drop revoked items from the model input and from redisplay. Where a summary’s sources are unknown, restrict reuse and offer a fresh conversation. Hiding the old summary in the browser does not remove it from server-side context. Handle copies made while a user was authorized under your records and incident procedures. The revocation test checks what the service still provides. OWASP — AI Agent Security Cheat Sheet[3]
Check whether the citation may be shown and whether its target can be opened. If immediate revocation is necessary, test whether a signed URL remains usable before it expires. A download proxy can check permissions at request time. Record how long older links work and separately inspect autocomplete, previews, link cards, file names, and downloads.
Test new and existing sessions around a department transfer
Suppose a sales employee named Minji transfers to HR. A previous answer cited a restricted quote for a fictional customer named Dawn. The quote contains a test-only marker, “Blue Bolt 73.” Minji keeps access to general instructions but needs a separate grant for reviews. Test using the exact ID and using a paraphrased question without the ID. A fictional marker helps identify the source of a leak.
| Path | Before transfer | Expected after transfer | Evidence |
|---|---|---|---|
| Same question in new chat | Sales quote and citation available | No restricted quote, title, or marker | Candidate IDs, version, allowed model inputs |
| Follow-up in an open chat | Prior source can be reused | Summary does not reintroduce quote | Recheck time and removed sources |
| Question after warming answer cache | Authorized answer may be cached | Cached output is not served if now forbidden | Cache decision and permission version |
| Reopen earlier citation in another tab | Download with current rights | Block content, preview, and title according to policy | Link type and server-side file check |
| Request started before withdrawal | In progress or awaiting reply | Recheck under newer rights before delivering | Start, change, response times and decision |
| General instructions and HR reviews | General allowed; HR denied | General allowed; HR still denied without grant | Side-by-side positive and negative results |
Test requests already in progress. If revocation is detected after retrieval but before delivery, the system may need to cancel or mask the answer. Streams may already have delivered some text, so define the pre-delivery check and the scope of interruption. Agree on the effective time and affected paths with business and test owners. For a search exposed through MCP, include tool and connection revocation from the production MCP security checklist.
Match the change record to evidence of denial
HR, identity provider, search index, and application can each record a different transition time. Define which event starts revocation, then retain the last observed allow and first observed deny. If a test still allows access at 20 seconds and denies it at 30 seconds, the transition fell within that observation window. The test did not identify an exact cutoff or prove every instance changed together.
Also test peak hours and a stalled indexer. If the permission service cannot confirm a current version, a service can block sensitive sources and show general help. Where a full stop is costly, temporarily exclude the restricted source while the new index is prepared. A restored role should pass authorization with the new grant. Avoid reviving an old answer cache as a substitute for a fresh decision.
Retain references instead of copying documents into monitoring. Keep test IDs and approved markers, policy versions, candidate results and decisions, cache status, and execution IDs. State coverage and duration and compare them with the operating objective. If sensitive material resurfaces, hold the affected source or feature and repeat both denied and allowed cases after repair. NIST AI 600-1[4]
