RAG is useful when people need answers from documents they already have rights to see. It is dangerous when the index ignores those rights, when prompts can pull neighbouring chunks, or when nobody can explain what the model was allowed to read.
Start with the corpus. Which shares, sites and systems? Who owns retention? Can you delete a document and have it leave the index? If you cannot answer those, do not connect a model yet.
In one design review, an internal assistant built over SharePoint would have let a junior employee ask about redundancy terms and get an answer citing a confidential document. A finance folder was restricted to a handful of people, but the search index had been built by a service account that could read everything. The fix was to check the asker's group membership at query time in the retrieval layer, not to trust the index.
Access control must be enforced at retrieval time, not only at the chat UI. If the search layer can return a chunk from a folder the user cannot open, you have built a bypass. Entra groups, ACL expansion, and document-level permissions are dull and non-negotiable.
Logging belongs in the design: who asked, which documents were retrieved, which model ran, where the answer went. Legal and security will ask. Build the trail while the system is small.
A safe first system is narrow: a well-owned policy library, or a runbook set, with a human still responsible for actions. Do not point a general assistant at every file share and call it an AI program. That is how confidential HR folders end up in a demo. Models here are a delivery mechanism on a scoped engineering problem, not the product.
Want AI running on infrastructure you can trust? AI Infrastructure & Automation
All resources