hardScenarioDesignSeniorStaffLead
A user's access to a document set is revoked. What has to happen across your RAG stack?
6 min readUpdated 2026-08-15
Answer
Short answer
Revoke once in the authorisation store, then propagate to the index ACLs, every cache holding text or results, any derived summaries and embeddings, and the conversation transcripts still carrying passages.
Was this answer helpful?
Likely follow-ups
- Removing one person from one group revokes access to nine hundred thousand chunks. What does that cost you?
- The authorisation service is unreachable when a query arrives. What does retrieval do?
- How do you answer an auditor asking whether anything derived from a revoked document still exists?
- What changes if the revocation is a legal instruction rather than a routine offboarding?
Related questions
- How do you enforce per-user permissions in a retrieval system?hardAlso on authorisation and rag-security6 min
- A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?hardAlso on authorisation6 min
- An erasure request arrives and the person's data is in backups, an event stream, a warehouse copy and a training set. What can you honestly delete?hardAlso on data-lineage7 min
- A figure in a regulatory return you already submitted turns out to be wrong. What happens next, and what should the system have been built to do?hardAlso on data-lineage6 min