Elamur Research⌕
☰
home / papers / 2026 / Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems

Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems

Paper · 2026 · Rohith Namboothiri

Summary

When a RAG assistant serves many users under role-based access control, similarity search ignores permissions. Restricted chunks can therefore enter the LLM context before any downstream filter or guardrail acts. The paper treats this as a question of pipeline ordering. It proposes Authorization-First Retrieval (AFR): permission checks must limit the candidate set before any learned component sees the content. Using the classical non-interference property, the author proves AFR is required whenever the model is not non-interfering. Both tested LLMs fail that property. A further theorem extends the guarantee to multi-agent chains under inherited delegation, though experiments cover only a single-agent pipeline. The evaluation uses a controlled enterprise corpus with Gemini 2.0 Flash and GPT-4o-mini. It compares retrieve-then-filter (D3) with AFR (D6) and adds studies of negation framing, benign contamination, stale metadata tags, chunk size and retrieval depth. D3 leaks restricted context on most queries, and AFR removes structural leaks entirely. The takeaway is that authorization must be enforced architecturally rather than through model behavior.

Key points

  • Corpus and queries: 247 chunks from 232 documents, 12 enterprise roles and 9 domains. There are 431 base queries, plus 108 negation-exploitation and 45 parametric-probing queries, for 584 in total.
  • Leak rates:
    • Retrieve-then-filter exposes unauthorized chunks on 371/431 base queries (86.1%) for both models. AFR exposes 0/431.
    • Answer-level leakage under D3 is 41.3% for Gemini 2.0 Flash and 29.5% for GPT-4o-mini.
  • Stale metadata tags: Once a single policy update cycle has passed, relying on metadata tags for pre-filtering brings structural leaks back for 9.7% of queries.
  • Stress tests: At k=150 (the full corpus), D3 structural exposure rises to 90.7%. AFR stays at 0% across five chunk sizes (30–200 words, 667–1,718 chunks) on both models.
  • Latency: AFR was faster at k=10, cutting mean latency by about 23% (Gemini 1,976→1,524 ms; GPT-4o-mini 2,582→1,973 ms). The gain comes mostly from short refusals on deny queries.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksSocial Sciences · 1,772 worksSociology and Political Science · 577 works

🧭 Topics 1Research subjects and languages the work is about.Information retrieval & search · 473 works

Cite

Cite as Rohith Namboothiri. 2026. Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems. Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.trustnlp-main.15

@inproceedings{namboothiri2026authorization,
  title = {{Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems}},
  author = {Rohith Namboothiri},
  booktitle = {Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)},
  year = {2026},
  doi = {10.18653/v1/2026.trustnlp-main.15},
  url = {https://doi.org/10.18653/v1/2026.trustnlp-main.15}
}

References

73 references, 22 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. [2] Y. Gao et al., “Retrieval-Augmented Generation for Large Language Models: A Survey,” arXiv:2312.10997, 2024.
  2. All experiments use a fully synthetic corpus with no real employee data, medical records, or finan- [3] V. Karpukhin et al., “Dense Passage Retrieval for cial information. The authorization failures we Open-Domain Question Answering,” in EMNLP, pp. 6769–6781, 2020. demonstrate are disclosed to motiv…
  3. Use of AI Assistants [5] G. Izacard and E. Grave, “Leveraging Passage Retrieval with Generative Models for Open Domain Question Answering,” in EACL, pp. 874–880, 2021.
  4. We used large language models (Claude, Chat- [6] A. Asai et al., “Self-RAG: Learning to Retrieve, GPT) for grammar and language polishing of the Generate, and Critique through Self-Reflection,” in ICLR, 2024. manuscript text. We used coding assistance from these models for portions of the experiment…
  5. [26] Q. Wu et al., “AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation,” arXiv:2308.08155, 2023.
  6. [9] G. Mialon et al., “Augmented Language Models: a Survey,” arXiv:2302.07842, 2023.
  7. [27] S. Hong et al., “MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework,” arXiv:2308.00352, 2023.
  8. [10] J. Johnson et al., “Billion-Scale Similarity Search with GPUs,” IEEE Trans. Big Data, vol. 7, no. 3, pp. 535–547, 2021. find
  9. [28] S. Yao et al., “ReAct: Synergizing Reasoning and Acting in Language Models,” in ICLR, 2023.
  10. [11] Y. A. Malkov and D. A. Yashunin, “Efficient and Robust Approximate Nearest Neighbor Using Hierarchical Navigable Small World Graphs,” IEEE TPAMI, vol. 42, no. 4, pp. 824–836, 2020. find
  11. [12] R. S. Sandhu et al., “Role-Based Access Control Models,” IEEE Computer, vol. 29, no. 2, pp. 38–47, 1996. find
  12. [29] T. Schick et al., “Toolformer: Language Models Can Teach Themselves to Use Tools,” in NeurIPS, vol. 36, 2024.
  13. [30] S. G. Patil et al., “Gorilla: Large Language Model Connected with Massive APIs,” arXiv:2305.15334, 2023.
  14. [31] J. S. Park et al., “Generative Agents: Interactive Simulacra of Human Behavior,” in UIST, pp. 1–22, 2023. find
  15. [13] D. F. Ferraiolo and D. R. Kuhn, “Role-Based Access Controls,” in 15th Nat. Comp. Sec. Conf., pp. 554–563, 1992. find
  16. [14] V. C. Hu et al., “Guide to Attribute Based Access Control (ABAC) Definition and Considerations,” NIST SP 800-162, 2014. find
  17. [15] R. Pang et al., “Zanzibar: Google’s Consistent, Global Authorization System,” in USENIX ATC, pp. 33–46, 2019. find
  18. [16] P. Samarati and S. de Capitani di Vimercati, “Access Control: Policies, Models, and Mechanisms,” in FOSAD, LNCS 2171, pp. 137–196, 2001. find
  19. [17] B. W. Lampson, “Protection,” ACM SIGOPS OSR, vol. 8, no. 1, pp. 18–24, 1974. find
  20. [18] D. E. Bell and L. J. LaPadula, “Secure Computer Systems: Mathematical Foundations,” Tech. Rep. MTR-2547, MITRE, 1973. find
  21. [19] D. D. Clark and D. R. Wilson, “A Comparison of Commercial and Military Computer Security Policies,” in IEEE S&P, pp. 184–194, 1987. find
  22. [20] R. S. Sandhu, “Role-Based Access Control,” in Advances in Computers, vol. 46, pp. 237–286, 1998. find
  23. [21] M. Y. Becker and P. Sewell, “Cassandra: Distributed Access Control Policies with Tunable Expressiveness,” in POLICY, pp. 159–168, 2004. find
  24. [32] G. Li et al., “CAMEL: Communicative Agents for ‘Mind’ Exploration of Large Language Model Society,” in NeurIPS, vol. 36, 2023. — CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Society
  25. [33] C. Qian et al., “Communicative Agents for Software Development,” in ACL, 2024. find
  26. [34] K. Hines et al., “Defending Against Indirect Prompt Injection Attacks With Spotlighting,” arXiv:2403.14720, 2024. — [arXiv:2403.14720](https://arxiv.org/abs/2403.14720) find
  27. [35] J. Yi et al., “Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models,” in KDD, 2025. find
  28. [36] K. Greshake et al., “Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” in AISec, pp. 79–90, 2023. find
  29. [37] Y. Liu et al., “Prompt Injection Attack Against LLM-Integrated Applications,” arXiv:2306.05499, 2024.
  30. [38] A. Zou et al., “Universal and Transferable Adversarial Attacks on Aligned Language Models,” arXiv:2307.15043, 2023.
  31. [39] A. Wei et al., “Jailbroken: How Does LLM Safety Training Fail?” in NeurIPS, vol. 36, 2024.
  32. [22] OpenFGA, “OpenFGA: Fine-Grained Authorization,” https://openfga.dev, 2024. ↗
  33. [40] X. Shen et al., “Do Anything Now’: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on LLMs,” in CCS, 2024. find
  34. [23] Cerbos, “Cerbos: The Open Source Authorization Layer,” https://cerbos.dev, 2024. ↗
  35. [41] S. Zhu et al., “AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned LLMs,” in ICLR, 2024. find
  36. [24] Open Policy Agent, “OPA: Policy-based Con- [42] E. Perez et al., “Red Teaming Language Models trol for Cloud Native Environments,” https://www.with Language Models,” in EMNLP, pp. 3419–3448, openpolicyagent.org, 2024. 2022. ↗
  37. [25] OWASP, “OWASP Top 10 for Large Language Model Applications,” Version 2025, November 2024. find
  38. [43] N. Carlini et al., “Extracting Training Data from Large Language Models,” in USENIX Security, pp. 2633–2650, 2021.
  39. [44] N. Carlini et al., “Quantifying Memorization Across Neural Language Models,” in ICLR, 2023. find
  40. [62] M. Abadi et al., “Deep Learning with Differential Privacy,” in CCS, pp. 308–318, 2016. find
  41. [45] M. Nasr et al., “Scalable Extraction of Training Data from (Production) Language Models,” arXiv:2311.17035, 2023.
  42. [63] I. Issa et al., “An Operational Approach to Information Leakage,” IEEE Trans. IT, vol. 66, no. 3, pp. 1625–1657, 2020. find
  43. [46] R. Staab et al., “Beyond Memorization: Violating Privacy Via Inference with LLMs,” in ICLR, 2024. find
  44. [64] L. Huang et al., “A Survey on Hallucination in Large Language Models,” arXiv:2311.05232, 2023.
  45. [47] N. Lukas et al., “Analyzing Leakage of Personally Identifiable Information in Language Models,” in IEEE S&P, pp. 346–363, 2023. find
  46. [48] S. Zeng et al., “The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG),” arXiv:2402.16893, 2024. find
  47. [65] N. Kassner and H. Schütze, “Negated and Misprimed Probes for Pretrained Language Models,” in ACL, pp. 7811–7818, 2020. find
  48. [66] A. Ettinger, “What BERT Is Not,” TACL, vol. 8, pp. 34–48, 2020. find
  49. [49] H. Brown et al., “What Does it Mean for a Language Model to Preserve Privacy?” in FAccT, pp. 2280–2292, 2022. find
  50. [50] W. Zou et al., “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation,” arXiv:2402.07867, 2024. find
  51. [51] H. Su et al., “A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents,” arXiv:2506.23844, 2025. — [arXiv:2506.23844](https://arxiv.org/abs/2506.23844) find
  52. [67] M. Nadeem et al., “Do LLMs Know When to Not Follow Instructions?” arXiv, 2024. find
  53. [68] F. Petroni et al., “Language Models as Knowledge Bases?” in EMNLP, pp. 2463–2473, 2019.
  54. [69] N. F. Liu et al., “Lost in the Middle: How Language Models Use Long Contexts,” TACL, vol. 12, pp. 157–173, 2024.
  55. [70] Y. Lu et al., “Fantastically Ordered Prompts and Where to Find Them,” in ACL, pp. 8086–8098, 2022. find
  56. [52] Y. Ruan et al., “Identifying the Risks of LM Agents with an LM-Emulated Sandbox,” in ICLR, 2024. find
  57. [53] B. Wang et al., “DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models,” in NeurIPS, vol. 36, 2023.
  58. [71] J. Hayes et al., “LOGAN: Membership Inference Attacks Against Generative Models,” PoPETs, vol. 2019, no. 1, pp. 133–152, 2019. find
  59. [54] L. Sun et al., “TrustLLM: Trustworthiness in Large Language Models,” arXiv:2401.05561, 2024.
  60. [72] H. Li et al., “Privacy in Large Language Models: Attacks, Defenses and Future Directions,” arXiv:2310.10383, 2024. — [arXiv:2310.10383](https://arxiv.org/abs/2310.10383) find
  61. [55] N. Hardy, “The Confused Deputy,” ACM SIGOPS OSR, vol. 22, no. 4, pp. 36–38, 1988. find
  62. [73] Amazon Web Services, “Amazon Bedrock Knowledge Bases,” https://docs.aws.amazon.com/ bedrock/, 2024. ↗
  63. [56] J. A. Goguen and J. Meseguer, “Security Policies and Security Models,” in IEEE S&P, pp. 11–20, 1982. find
  64. [57] D. E. Denning, “A Lattice Model of Secure Information Flow,” CACM, vol. 19, no. 5, pp. 236–243, 1976. find
  65. [58] A. Sabelfeld and A. C. Myers, “Language-Based Information-Flow Security,” IEEE JSAC, vol. 21, no. 1, pp. 5–19, 2003. find
  66. [59] A. C. Myers and B. Liskov, “Protecting Privacy using the Decentralized Label Model,” ACM TOSEM, vol. 9, no. 4, pp. 410–442, 2000. find
  67. [74] LangChain, “LangChain: Building Applications with LLMs through Composability,” https://github.com/langchain-ai/langchain, 2023. ↗
  68. [75] LlamaIndex, “LlamaIndex: Data Framework for LLM Applications,” https://github.com/ run-llama/llama_index, 2023. ↗
  69. [76] Q. Zhan et al., “InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents,” in Findings of ACL, 2024. find
  70. [60] D. E. Denning et al., “The Tracker: A Threat to Statistical Database Security,” ACM TODS, vol. 4, no. 1, pp. 76–96, 1979. find
  71. [77] Z. Xiang et al., “GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning,” arXiv:2406.09187, 2024. — [arXiv:2406.09187](https://arxiv.org/abs/2406.09187) find
  72. [61] C. Dwork et al., “Calibrating Noise to Sensitivity in Private Data Analysis,” in TCC, pp. 265–284, 2006. find
  73. [78] X. Qi et al., “Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To,” in ICLR, 2024. — Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/namboothiri-2026-authorization-first-retrieval-enforcing-least/