A document search assistant may answer from a copy of information rather than the original file. The source document can lose a reader while its extracted text remains in a search index, a conversation, or an answer cache. A permission change therefore has to be understood across the entire retrieval path.
Retrieval-augmented generation, or RAG, adds selected source material to a model's context. That improves access to company information, but it also makes the retrieval service part of the company's authorization system.
Search relevance does not establish permission
An embedding helps a system find material related to a question. It does not establish whether the person asking may read that material. OWASP identifies unauthorized access and cross-context disclosure among the risks of shared vector stores. Its vector and embedding guidance calls for permission-aware retrieval and separation between access groups.
Consider a synthetic acquisition folder restricted to a small review team. An employee initially belongs to that team and can ask the assistant questions about the folder. After removal, a search result that still includes extracted paragraphs could disclose information even if the original document link now returns an access error.
Follow each copy of the document
Map ingestion, chunk storage, search filtering, model context, cached responses, and citation previews. Identify which component stores a permission snapshot and which checks the current source permission. Record how quickly a revocation is expected to propagate through each component.
There is a practical distinction between preventing new retrieval and removing information already displayed to an authorized person. A permission change cannot make that person forget an earlier answer. It can prevent the service from serving new answers, reopened previews, or saved conversations that the product's access policy no longer permits.
Test the transition, not only the initial setup
Create two test users and documents with unique, non-sensitive phrases. Give one user temporary access, confirm a legitimate answer, then revoke access at the source. Repeat the same query and several paraphrases. Test both a new conversation and any supported shared or saved conversation view.
Measure the time until unauthorized retrieval stops. Inspect the retrieved chunks as well as the generated response: a model might omit a protected phrase even though the retrieval layer improperly supplied it. That omission would not establish that the permission boundary worked.
Define an operational acceptance condition
An acceptance record can specify the permitted propagation delay, the affected indexes, and what happens while permission synchronization is unavailable. Failing closed for protected content may be appropriate where a current access decision cannot be established. The product owner also needs a clear user experience for unavailable results.
Include folder moves, group changes, external sharing removal, and employee departure in later checks. These events exercise different integration paths. For a security assessment, the useful evidence is a trace from the source permission change to the retrieval decision, with any remaining copies and retention behavior documented.
Sources
OWASP: RAG Security. The acquisition-folder example is a proposed test scenario using synthetic information.
