Auth0 FGA RAG adapters could retrieve documents under the wrong authorization context

Auth0 AI Python retrieval adapters could conflate user, relation or condition contexts where documents shared an underlying Fine-Grained Authorization object. A denied document could therefore enter the language model retrieval context despite the policy store correctly denying that particular access.

The affected versions are auth0-ai-langchain before 1.0.2 and auth0-ai-llamaindex before 1.0.3. The defect concerns how the adapter groups and applies document checks, not a universal weakness in the FGA service. An answer or tool result can leak previously denied material after the retrieval boundary fails, even if the eventual assistant does not call an obviously privileged tool.

The upstream advisory does not identify a real customer leak, and its affected-version wording needs to be reconciled with the published fixed packages. Patch both adapters as deployed and test mixed-principal, relation and condition requests using distinguishable private documents.

Evidence reconciliation and effect boundary. This is a retrieval authorization error before generation. The problem is not that a model invented a document, but that a search adapter could pass a real document from the wrong user or relation context to the model. Fixing prompt wording alone cannot restore a server-side document boundary; the service must bind each returned document to the effective principal, relation and conditions at result assembly time. Actual customer disclosure remains unconfirmed.