Data Access and RAG
Retrieval-augmented generation creates a security boundary around which sources can be searched, whose permissions apply, and what evidence identifies the source of an answer.
Classify Before Connecting
Use a small, enforceable classification model, for example:
| Class | Examples | AI access policy |
|---|---|---|
| Public | Published website and public documentation | May be used by public agents after content review |
| Internal | Procedures and general company knowledge | Authenticated users and approved teams |
| Confidential | Customer, finance, legal, HR, or commercial data | Named teams, explicit owner, no public agent access |
| Restricted | Credentials, highly regulated records, privileged security data | Do not ingest unless the approved use case requires it and controls are documented |
Required Controls
For each data collection:
- Assign a business owner and a technical owner.
- Record its classification, purpose, source system, and expected users.
- Connect only sources required by the agent's purpose.
- Preserve source identity and useful metadata for traceability.
- Enforce organization, team, user, and collection access consistently.
- Separate public knowledge from internal and customer-specific knowledge.
- Define refresh, deletion, and access-review procedures.
- Test that an unauthorized user cannot retrieve or infer restricted content.
Retrieved Content Is Untrusted
A document can contain malicious instructions even when the user is allowed to read it. The agent should use retrieved text as evidence, not as a new authority. Pair retrieval permissions with the controls in Prompt Injection.
For product setup and operational checks, see Govern Data Collections and Sources and Data Collections.