Authorize RAG retrieval with Cerbos dynamic filters

Enforce document-level access control on vector store retrieval by translating Cerbos policy decisions into dynamic metadata filters.

Document-level access control

Enforce per-document authorization on vector search results using Cerbos policies and metadata filters

Dynamic retrieval filters

Translate Cerbos query plans into vector store metadata filters at retrieval time, based on the requesting user's context

Store-agnostic

Works with any vector store that supports metadata filtering, including Pinecone, ChromaDB, Weaviate, and Qdrant

How Cerbos works with RAG (Retrieval-Augmented Generation)

AI agents and tools introduce a new class of authorization challenges. They act on behalf of users, access sensitive data, and chain operations, all of which need fine-grained access control.

Cerbos provides policy-driven authorization that controls what AI systems can do, which data they can access, and on whose behalf. Policies are written in human-readable YAML and evaluated at request time.

With Cerbos and RAG (Retrieval-Augmented Generation), you get guardrails that scale with your AI adoption, centrally managed policies, full audit trails, and sub-millisecond decision times that don't slow down agent workflows.

How Cerbos secures RAG retrieval

1. Define document access policies in YAML: Write resource policies that describe who can access which documents, using roles, attributes, and metadata.
2. Request a query plan from Cerbos: Your application calls the PlanResources API with the user's context, and Cerbos returns an abstract query plan.
3. Convert the plan into vector store metadata filters: Map the Cerbos query plan to your vector store's native filter format so authorization is enforced at the retrieval layer.
4. Vector store returns only authorized documents: Similarity search executes with authorization filters applied, no post-retrieval filtering required.

Security risks of unsecured RAG pipelines

Without authorization-aware retrieval, RAG pipelines introduce data access risks that traditional application security doesn't cover:

• Data leakage through retrieval: Similarity search can return documents the requesting user isn't cleared to see — internal memos, restricted reports, or data from other tenants.
• Incomplete identity context: The retrieval layer often lacks the user's full profile, making it impossible to enforce department-level, classification-based, or tenant-scoped access controls.
• No audit trail: Without authorization checks at retrieval time, there's no record of which documents were surfaced to which users — making compliance reporting and incident investigation impossible.
• Post-retrieval filtering is insufficient: Filtering results after the vector search returns them still exposes document metadata and can leak information through result counts and ranking patterns.

Richer RAG decisions with Cerbos Synapse

RAG pipelines often lack the full identity context needed for fine-grained document filtering. Cerbos Synapse enriches authorization requests with the user's full profile from your identity provider and document metadata from your data stores — so the PDP can generate precise query filters without the retrieval layer needing to assemble this context.

FAQ

How does Cerbos filter RAG retrieval results?

Cerbos evaluates your authorization policies and produces a query plan. Your application converts that plan into metadata filters for your vector store, so similarity search only returns documents the user is authorized to access.

Which vector stores does this work with?

Cerbos query plans are vector-store agnostic. You translate the plan into whatever metadata filter format your store supports, including Pinecone, ChromaDB, Weaviate, Qdrant, and others.

Does this replace application-level authorization?

No. Data-level filtering complements API-level checks. The same Cerbos policies that control endpoint access also determine which documents are visible during retrieval.