RAG retrieval boundaries
Retrieval is an authorization decision. If the index returns another user's chunk, the model did not cause that, the query did.
Tags: rag, llm, idor, retrieval
Checklist
- Corpus map: What is indexed: uploads, tickets, wiki, mail, or drive. Note per-user, per-tenant, or global.
- Filter identity: Which user and tenant the retriever filters on. A sentence in the prompt is not a filter.
- Marker across users: Upload a unique marker as user A. Ask as user B. The marker in B's answer or citations is the result.
- Citations: Titles, document ids, and snippets in the citation. Listing a document the caller cannot open is the note.
- Client filters: Collection, folder, or ACL fields the client sends. Changing them should not widen the corpus beyond that user.
- Revoke and delete: Remove a share or delete the file, then ask again. Record whether the chunk still answers and how long that lasts.
- Follow-up tools: If the answer can call fetch or export, that tool should use the same identity as the chat user.
- One corpus you own: Do not ask for other customers' documents. One marker in a corpus you created is the proof.