Topic · DiggingBeagle record
Retrieval authorization must follow each result into model context
A secure database policy can coexist with an unsafe retrieval adapter, shared keyword index or cached generated response.
- Topic kind
- pattern
Definition & limits
Retrieval systems often combine multiple permission decisions before constructing model input: a database role, a document-level policy, a keyword search and a response cache. If any intermediate component reuses a different principal's state, the model may receive forbidden text without knowingly breaking an instruction.
The Auth0 FGA advisory documents confused document authorization context, while the pgEdge RAG advisory documents concurrent BM25 index reuse across tenants. Kong's AI Gateway cache adds a later-stage version of the same trust problem: a previously generated response may survive beyond the identity that requested it. These are three separate root causes, not one coordinated attack.
Testing needs distinguishable tenant markers, concurrent requests, verified effective principal identity and an inspection of the exact text placed in the model context or returned to the caller. A policy that correctly denies direct database access is insufficient evidence of end-to-end retrieval isolation.
Boundary-specific experiments. For the Auth0 adapter flaw, create two marked documents sharing a policy object but differing in the effective user, relation or condition. For the pgEdge BM25 race, interleave two filtered retrievals under contention and inspect each request's index contents and returned text. For the Kong caching problem, send structurally similar authenticated requests with distinct principal-specific canaries and then repeat them after permission revocation. In all three, record what reached the model or final user, not merely the database policy's intended decision. These tests identify separate root causes and should not be combined into one incident attribution.
Examples
- Different principals retrieve documents sharing one FGA object.
- Concurrent BM25 queries contain private tenant-specific markers.
- Two authenticated users request a semantically similar AI answer through a shared response cache.