RAG Access Control Services for Your Business
Secure RAG access control makes sure a person can only retrieve passages from documents they are already allowed to open. Omeiro maps permissions from Active Directory, Okta, Azure AD or LDAP onto your vector index, so retrieval filters by role before the model sees anything.
How RAG access control works, step by step
A made-up example of one run, from start to finish. Each step is logged so you can see what happened.
- Your documents are loaded
Files are split, indexed and kept in your own storage.
- A question comes in
The system finds the parts of your documents that match.
- The model answers from them
Answers point back to the source so people can check.
- People review the edge cases
We agree what happens when no good answer is found.
Sample Made-up names, data and steps to show how a run is logged. Your steps, tools and rules follow your business.
What you get with RAG access control
Granular document permissions mapped to vector indexes. Ensuring users only retrieve information permitted by their Active Directory, Okta, or LDAP organizational roles.
Basic Package
Metadata-based access filters for up to 5 roles in 1 vector index. 6-day delivery, 1 round + 30-day fixes.
Standard Package
Okta/Azure AD group sync, per-tenant namespaces, tests, docs. 10-day delivery, 1 round + 30-day fixes.
Premium Package
LDAP; SSO, document-level ACL sync, audit logs, 30 days support. 16-day delivery, 1 round + 60-day fixes.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Third-party tools, API usage and hosting are billed to your own accounts, so the setup stays with your business.
How our RAG access control works
List roles and sources
We record groups, documents and who may read what.
Tag the index
Every passage carries the permission data it needs.
Filter at query time
Each search is limited to what the signed-in user may see.
Test the boundaries
We try queries as different users to confirm nothing leaks.
Secure RAG access control: mapping permissions to the index
Permissions must travel with every passage. Secure RAG access control only works if each chunk of text carries the access rules of its source document, so before ordering, find out where those rules live: SharePoint groups, Google Drive sharing, folder ACLs or application roles. Some systems have messy, inherited permissions, and we need to understand them first. Document the roles that matter and the few high-risk collections, such as HR, legal and finance, that must be tested hardest.
Filtering must happen before the model sees text. Secure RAG access control that filters after generation can still leak facts into the answer, so retrieval is restricted at query time using the signed-in user's groups. Plan for change: people join teams, leave companies and documents move, so sync frequency matters. Ask for leak tests that run as different users and keep them as regression tests, repeating them whenever you add a source or change an identity setup.
In short
- Delivery in 6 to 16 days, by package.
- Fixed price, shown before you order.
- SaaS builders who must separate each customer's data in one index.
- Copyright yours after full payment.
RAG Access Control: common questions
How much does RAG access control cost?
Prices are fixed and shown by package on our RAG Access Control pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does vector database permissions take?
Delivery depends on the package: Basic 6-day delivery; Standard 10-day delivery; Premium 16-day delivery.
What is included in the Basic Package?
The Basic Package includes: Metadata-based access filters for up to 5 roles in 1 vector index. Higher packages add more scope, revisions and support.
Can I get a custom multi tenant RAG security package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
Can permissions stay in sync when groups change?
Standard syncs Okta or Azure AD groups, and Premium syncs document-level ACLs.
Does it work with my vector database?
Tell us which one you use before ordering.
How do you test for leaks?
By running queries as users with different roles and checking results.
Is there a record of who searched what?
Premium adds audit logs.
What is row-level security for vector search?
It means each stored passage carries permission data, and every search is filtered so a user only retrieves passages they are entitled to see. It is the vector-database version of row-level security in SQL.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your RAG access control?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.