Paul Bryant • 9/10/2026

Retrieval Permissions Must Follow the User, Not the Service Account

This article explains that RAG retrieval permissions must reflect the effective requester, application scope, and content restrictions—not just a valid login or service account. It covers request-time authorization, separating user rights from application access, and preserving controls through search expansion, caches, and conversation history. It also addresses permission revocation and identity resolution failures.

0 comments

#authorization #permissions #Access Control