RAG is not the product. The permission model is the product

Hot take from building Sahayi for a year: every AI support demo looks magical until you ask whose documents it is allowed to read. Multi-tenant help centers, draft-vs-published articles, per-plan feature docs, ex-employee Slack threads still indexed somewhere. The retrieval is easy. The access control is the product.

We now treat every chunk with three ACL tags (tenant, plan tier, publish state) and filter before ranking, not after. Filtering after ranking leaks titles through scores and snippets. Ask me how I know.

What is your scariest almost-leak?

This is the correct take and almost nobody ships it. Same class of bug as search: filter-then-rank or you leak. How do you handle chunks that are shared across tenants with tenant-specific overrides?

Shared base chunk plus overlay chunks, overlay wins, both carry tenant tags. Overrides are small and frequent, base is big and stable. Works until someone edits the base and forgets the overlay exists. We now show both in the reviewer UI.

Sceptical AI person checking in: the other half of this is that most companies should not index Slack at all. Half the "knowledge" in Slack is wrong, outdated, or two people arguing. Curate first, index second.

Preach. Our onboarding now starts with "show me your docs" and if the answer is "it is all in Slack" we quote the cleanup project first. Best customers have boring, maintained help centers.

Database-brain translation: this is row-level security for embeddings. We do the same shape for Vetka previews: branch tags on every row, filter before similarity. The moment you rank-then-filter, the timing alone leaks.

My almost-leak: internal refund policy draft indexed from a Google Doc with "LINK SHARING ON". Indexed for six days. Now the connector refuses anything shared wider than the support group. Boring fix, cold sweat included free of charge.