# Data-Layer ACLs

Enforce who can see which documents in the retrieval/data layer — never by asking the model in the prompt to filter.

## Why the CCAR-P exam tests this

This is the headline RAG security trap of P3: leaking documents across users because authorization was done in the wrong layer.

## Definition

In a multi-tenant or multi-user RAG system, every retrieval must return **only documents the requesting user is authorized to see**. That authorization has to be enforced at the **data layer** — as a filter on the query itself, using per-document ACL/owner metadata (`user_id`, `group`, `tenant`, `acl`) indexed alongside each chunk — so unauthorized content is never even fetched.

The critical failure mode is enforcing access via **prompt instructions** — e.g. 'only answer using documents this user owns.' Prompts are not a security boundary: the model may be jailbroken, may err, or the sensitive text is already in its context window and can leak. If a chunk reaches the prompt, treat it as already disclosed.

Correct design: resolve the user's identity/entitlements server-side, then apply them as a hard **pre-retrieval filter** in the vector/hybrid store (and re-check post-retrieval). The same principle governs **MCP tools** — scope access via the delegated user token and least-privilege, not via instructions telling the model to behave.

## Exam trap

Putting the access rule in the system prompt is not access control — any answer that filters by document ownership using prompt text instead of a data-layer filter is the data-leak trap.

## Commonly confused with

- **rag-pipeline** — ACLs are a security constraint applied throughout retrieval; the pipeline is the mechanism they must be enforced within.
- **mcp** — MCP enforces access via delegated tokens and least-privilege tool scoping — the same 'not in the prompt' principle for the tool path.

## Related

- rag-pipeline
- mcp
- chunking-strategy
- observability-tracing

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P3). Not affiliated with Anthropic.