The challenge behind the engagement.
Retrieval-augmented generation (RAG) lets an AI assistant answer from your documents. This security test checks whether those answers respect access permissions. We map how content flows in and find where each user's permissions are enforced: in the search service or application code. Then we ask questions as users in different groups, using paraphrase and tampered queries, and inspect citations for data leaks. We add a document carrying hidden instructions through an agreed upload path and test whether it is retrieved and obeyed. We remove someone from a group and measure whether access changes reach the assistant. You receive an entitlement matrix, poisoning test evidence, and a measured timeline. Your real documents are not copied; we use test documents and users where possible.
For teams that have connected content sources such as wikis, file shares, or a ticketing system to an assistant. Schedule it before opening the assistant to the whole company, before a customer asks how document permissions are enforced, or after a report that someone saw a file they should not have.
What we do.
What you can use.
Map the pipeline and permission model
We work from a map of how content moves from its sources through to an answer, and match your permission model, whether groups, folder permissions, or custom access lists, to test users across groups and tenants. We agree permission to add one test document and change one access rule, and we get the index configuration and its refresh schedule.
Probe entitlements, poison, and time propagation
We query as each test user with plain language, paraphrase, closely related wording, and tampered filters, and press on filters built in application code. We add a document carrying instructions through a connected source such as a wiki, shared drive, or ticket and confirm it is retrieved and obeyed. Then we change a group membership and measure when the results change.
Deliver the entitlement matrix and timeline
You receive an entitlement matrix of expected versus observed access for each user and document type, the planted document and the response it produced, and a measured timeline. Pipeline findings carry fixes by control point: where permissions are enforced, how they attach to each piece of content, how often the index refreshes, and who can write to the sources. We retest after the changes land.
Who it’s for.
When you need it.
- Teams that connected wikis, file shares, or ticketing systems to a retrieval assistant
- Organizations whose retrieval corpus mixes content with different access permissions
- Product teams preparing to open a retrieval assistant to the whole company
- Security teams that must prove document entitlements are enforced at retrieval time
- A retrieval assistant is about to expand from a pilot group to everyone
- Someone reported seeing a document through the assistant they should not access
- A customer asks how per-document permissions are enforced inside the assistant
- A new content source or permission model was just connected to the index
What the scope can include.
- 01
Entitlement checks per group and tenant using plain, paraphrased, and closely related queries
- 02
Where each user's permissions are enforced: the search service, or filters built in code
- 03
Shared indexes and caches, and steps that run over everything before the permission filter
- 04
Poisoning the index by adding an instruction-bearing document through a connected source
- 05
Content that loses its permission tags when it is broken into pieces for the index
- 06
How long a permission change in the source takes to reach the assistant's answers
What it typically costs.
One rate: $150/hour.
Every engagement is priced by the hours it takes at one flat rate, with scoping, the work, and reporting, plus a retest of your fixes, included. Find the size closest to yours.
One assistant answering from one document source with a few permission groups
About 40–60 hoursOne assistant drawing on several sources, such as a wiki, shared drives, and tickets, with many groups
About 72–110 hoursA company-wide or customer-facing assistant over many sources with separate customer data
About 130–190 hours- Number of connected document sources
- How many permission groups and customer accounts must be checked
- Whether permissions are enforced by the search service or by custom code
- How long the index takes to refresh, which sets the permission-change timing test
Ranges are planning estimates at $150/hour, not a quote. Your price is confirmed in writing after a scoping call, before any work begins.
What you take forward.
- Entitlement matrix of expected versus observed access for each test user and document type
- Poisoning proof: the planted document, the query that retrieved it, and the response that followed it
- Measured timeline from a source permission change to the change in the assistant's answers
- Fixes by control point: where permissions are enforced, how they attach to content, refresh timing, and source controls
Final coverage, deliverables, timing, and any retesting or implementation work are confirmed before the engagement begins.
Before we get started.
We filter by group ID in code; is that enough?
It can be, but it is the weakest place to enforce it, and we test it hardest. A filter built in code depends on that code reading the right groups, applying them on every path a query can take, and never letting a prompt or a parameter change the filter. We also check what runs before the filter, since a step that ranks or rewrites across the whole collection can pull restricted content into view. Where the search service can enforce permissions itself, we show what moving enforcement there would change.
When we remove someone from a group, how fast does the assistant stop showing them documents?
We measure it rather than quote a vendor's figure. During the test we change one group membership or access rule in the source system, then keep asking as that user on a schedule until the results change, recording the elapsed time against your index's refresh cycle. Permission changes usually reach an assistant only after the index re-synchronizes, and some sources need an explicit refresh before inherited changes take effect. Others leave enforcement to your own code entirely. The timeline in your report is the number you can give customers and auditors.
- OWASP GenAI LLM Top 10 2026
- OWASP Top 10 for Agentic Applications for 2026
- GenAI Red Teaming Guide
- MITRE ATLAS
- NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- Model Context Protocol Specification: Authorization (2026-07-28)
- Document-Level Access Control - Azure AI Search