Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Search only what the user may see
Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.
OWASP AISVS v1.01, requirement 5.2.2
In plain English
When the assistant searches documents for someone, it must find only what that person is allowed to see. The service account behind the search usually has far wider access than any one user, so the search has to apply the user's own permissions at each step.
What good looks like
- Each retrieval query carries the end user's identity or permission filter, taken from a verified token and never from the prompt.
- Chunks in the index keep the access control information of their source document.
- Permission changes and deletions in the source system reach the index promptly.
- Tests with users at different permission levels show nobody retrieves a document they cannot open in the source system.
How teams usually do it
- Store the allowed users or groups as metadata on each chunk and filter on it inside the vector query. Search products call this security trimming.
- Check retrieved results against the source system or an authorisation service (for example OpenFGA or SpiceDB) before they are added to the prompt.
- Separate indexes or namespaces per tenant or permission group where filtering is not reliable enough.
Suggested evidence
- Query code showing the user filter.
- Test results for users at different permission levels.
- The sync process for permission changes, with its delay.
Common mistakes
- Indexing everything with a service account and filtering only in the user interface.
- Copying documents into the index without their permissions.
- Filtering results after the top-k search, so a user with little access gets empty answers and the team is tempted to loosen the filter.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.