# Authorize RAG retrieval with Cerbos dynamic filters

Enforce document-level access control on vector store retrieval by translating Cerbos policy decisions into dynamic metadata filters.

### Document-level access control

Enforce per-document authorization on vector search results using Cerbos policies and metadata filters

### Dynamic retrieval filters

Translate Cerbos query plans into vector store metadata filters at retrieval time, based on the requesting user's context

### Store-agnostic

Works with any vector store that supports metadata filtering, including Pinecone, ChromaDB, Weaviate, and Qdrant

## How Cerbos works with RAG (Retrieval-Augmented Generation)

AI agents and tools introduce a new class of authorization challenges. They act on behalf of users, access sensitive data, and chain operations, all of which need fine-grained access control.

Cerbos provides policy-driven authorization that controls what AI systems can do, which data they can access, and on whose behalf. Policies are written in human-readable YAML and evaluated at request time.

With Cerbos and RAG (Retrieval-Augmented Generation), you get guardrails that scale with your AI adoption, centrally managed policies, full audit trails, and sub-millisecond decision times that don't slow down agent workflows.

### How Cerbos secures RAG retrieval

1. **Define document access policies in YAML**: Write resource policies that describe who can access which documents, using roles, attributes, and metadata.
2. **Request a query plan from Cerbos**: Your application calls the PlanResources API with the user's context, and Cerbos returns an abstract query plan.
3. **Convert the plan into vector store metadata filters**: Map the Cerbos query plan to your vector store's native filter format so authorization is enforced at the retrieval layer.
4. **Vector store returns only authorized documents**: Similarity search executes with authorization filters applied, no post-retrieval filtering required.

### Security risks of unsecured RAG pipelines

Without authorization-aware retrieval, RAG pipelines introduce data access risks that traditional application security doesn't cover:

- **Data leakage through retrieval**: Similarity search can return documents the requesting user isn't cleared to see — internal memos, restricted reports, or data from other tenants.
- **Incomplete identity context**: The retrieval layer often lacks the user's full profile, making it impossible to enforce department-level, classification-based, or tenant-scoped access controls.
- **No audit trail**: Without authorization checks at retrieval time, there's no record of which documents were surfaced to which users — making compliance reporting and incident investigation impossible.
- **Post-retrieval filtering is insufficient**: Filtering results after the vector search returns them still exposes document metadata and can leak information through result counts and ranking patterns.

### Richer RAG decisions with Cerbos Synapse

RAG pipelines often lack the full identity context needed for fine-grained document filtering. [Cerbos Synapse](/content/product-cerbos-synapse/index.html) enriches authorization requests with the user's full profile from your identity provider and document metadata from your data stores — so the PDP can generate precise query filters without the retrieval layer needing to assemble this context.

## FAQ

### How does Cerbos filter RAG retrieval results?

Cerbos evaluates your authorization policies and produces a query plan. Your application converts that plan into metadata filters for your vector store, so similarity search only returns documents the user is authorized to access.

### Which vector stores does this work with?

Cerbos query plans are vector-store agnostic. You translate the plan into whatever metadata filter format your store supports, including Pinecone, ChromaDB, Weaviate, Qdrant, and others.

### Does this replace application-level authorization?

No. Data-level filtering complements API-level checks. The same Cerbos policies that control endpoint access also determine which documents are visible during retrieval.