Security trimming: the permission your RAG index silently deleted
Access denied on SharePoint — full answer from the chatbot. Two years into enterprise copilots, this is still the most common failure I find. The fix is called security trimming.
🔓 Security trimming: the permission your RAG index silently deleted.
Two years into enterprise copilots, one failure still shows up in almost every RAG review I do:
A team indexes SharePoint with a broad-access service account. The bot works beautifully. Then a user asks about a folder they were never given access to — and gets a fluent, sourced answer. The same user, on SharePoint directly, gets "Access denied."
Nothing was hacked. The document's ACL still protects the document — but nothing protects the embedding of it. The index is a copy made without the permissions, and your search layer has become a side door around every access decision the organisation ever made.
This problem has names, and knowing them makes the fix findable:
Security trimming — filtering retrieval results at query time against the asking user's actual permissions. The missing control.
The confused deputy problem — the decades-old vulnerability class underneath: a privileged intermediary acting for a low-privilege user, who then inherits the intermediary's access instead of their own.
Why it is serious: what leaks is exactly what ACLs exist to protect — salary data, M&A folders, client PII, pricing. It is silent (no breach alert fires; the system did what it was built to do). And it is an access-control failure in the compliance sense — "the file was locked but the chatbot recited it" is not a defence anyone wants to test. This is the same oversharing risk that, back in 2024, pushed 40% of IT leaders in a Gartner survey to delay copilot rollouts. Most of them delayed; fewer actually fixed the index.
Prevention, in order of what protects most:
Carry ACLs into the index; filter every query by user identity before results reach the model. Non-negotiable.
Retrieve as the user, not the service account — let the source system's own permission engine do the trimming.
Exclusion by default — HR, legal, deals and finance libraries stay out of the index unless deliberately included with trimming proven.
Sync permission drift — revoked access and deletions must propagate to the index on a clock someone monitors.
Clean the estate first — years of "shared with Everyone" links were survivable when finding files took effort. An assistant removes the effort.
And the ten-minute test that beats all of it: log in as your most junior-permissioned user and ask the bot for the three things that account must never see. If it answers, you found it before an employee, an auditor, or a regulator does.