Data-Layer ACLs

In a multi-tenant or multi-user RAG system, every retrieval must return only documents the requesting user is authorized to see. That authorization has to be enforced at the data layer — as a filter on the query itself, using per-document ACL/owner metadata (user_id, group, tenant, acl) indexed alongside each chunk — so unauthorized content is never even fetched.

The critical failure mode is enforcing access via prompt instructions — e.g. 'only answer using documents this user owns.' Prompts are not a security boundary: the model may be jailbroken, may err, or the sensitive text is already in its context window and can leak. If a chunk reaches the prompt, treat it as already disclosed.

Correct design: resolve the user's identity/entitlements server-side, then apply them as a hard pre-retrieval filter in the vector/hybrid store (and re-check post-retrieval). The same principle governs MCP tools — scope access via the delegated user token and least-privilege, not via instructions telling the model to behave.