A Vector Match Is Not Permission to Read the Document

An employee loses access to a project folder at noon. At 12:05 they ask an internal assistant about the project, and a matching paragraph still comes back from a vector index built that morning. The search did what it was designed to do: find a similar passage. The access-control system failed if it allowed that passage into the answer.

Two different questions are easy to collapse into one. Is this chunk relevant? belongs to retrieval. May this caller see this chunk now? belongs to authorization. The OWASP Authorization Cheat Sheet advises validating permissions on every request and denying by default. OWASP's LLM prompt-injection guidance separately describes how attacker-controlled retrieved text can redirect an agent. One is a confidentiality boundary; the other is an instruction-trust boundary. A system can fail either or both.

The revoked-access fixture

Create two synthetic documents with similar language and different access policies. Index both and query as a user initially allowed to see both. Remove that user's permission for one document without rebuilding the index, then run the same query. The protected chunk must not appear in the model's context, in its citations, in a streaming partial answer, or in a tool trace visible to that user. Test a direct document ID lookup as well as semantic search.

Store a stable document ID and policy reference with each chunk so the retrieval layer can consult current authorization before returning content to the model. Where an index has a tenant filter, verify the filter cannot be supplied or overwritten by model-generated arguments. Filtering only the final answer is too late: the model has already seen the data.

Finally, add a harmless instruction to the authorized document asking the agent to ignore the user's task. The correct outcome is to summarize it as source material, not follow it. This second check is about prompt injection and does not substitute for the revoked-access check.

A non-sensitive prompt-text review is useful as one preparation step, but BreakMyAgent's scanner cannot query your index or assert that revocations propagate. Evidence requires a real retrieval trace with synthetic documents and an authorization decision recorded before model context assembly.