AI Control Library / CF-12: Security & Abuse Resistance
Designation: Core | Control types represented: Operational and Technical
Control requirement
Enforce user- and tenant-appropriate authorization throughout knowledge retrieval, including document stores, indexes, embeddings, snippets, citations and caches. Recheck access when source permissions change.
Why this matters
Once unauthorized content reaches model context, output filtering may not reliably prevent disclosure. Access decisions must occur before protected material is supplied to inference.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to RAG, enterprise search, recommendation and agent memory systems using protected source information. Include indirect leakage through titles, counts or references.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Data owners define access; retrieval engineers enforce it; identity teams provide trustworthy user and tenant context.
Implementation guidance
- Propagate source permissions into indexes and retrieval decisions.
- Bind queries to authenticated user and tenant identity.
- Filter unauthorized content before it enters model context.
- Test permission changes, cache isolation and citation access.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unauthorized document query | Content and sensitive metadata are excluded. |
| Source permission revoked | Retrieval reflects revocation within the approved interval. |
| Shared cache request | Other users’ protected results are unavailable. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Permission design
- Index configuration
- Isolation tests
- Revocation checks
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable affected retrieval paths, purge exposed caches and investigate whether protected content reached users or external tools.
Example in practice
Hypothetical example: A user asks about a confidential acquisition. Retrieval excludes restricted board documents before composing context, even though their embeddings are present in the shared index.
Related controls
- CF12-002: AI System Least Privilege Access Control
- CF12-009: AI System Cache Security
- CF14-012: Agentic Memory & Context Security
Framework mappings
- CSA AICM (IAM-17)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0