An employee asks the AI assistant a question about a contract they have no role-based access to — and gets an accurate, well-cited answer with the full text of the terms. Formally, the system worked perfectly: it found the document and answered with a source. In substance, it's a data leak — it just traveled through a chat window instead of a file share.
That is exactly why RAG security cannot be bolted on after the system is already answering questions — it has to be part of the retrieval architecture from the start. Enterprise RAG touches contracts, personal data, technical schemes, and internal decisions, and the question is not "could the model accidentally say too much" but "does it even see what it shouldn't".
The NIST AI RMF (Generative AI Profile) and ISO/IEC 42001 frame this as a management problem, not only a technical one: roles and accountability, controls at the system's input and output, monitoring, and a process for regularly revising policy — the system shouldn't just be "configured once", it needs to be managed like any other corporate process with access to sensitive data.
Back to the contract example: the right architecture filters context before retrieval ever finds the document — if a user has no rights to a contract, the model shouldn't see its text in order to later "not quote it". Filtering after the fact, once the document has already been found and is merely hidden in the interface, does not protect against a leak through the act of generating an answer itself.
Beyond access control, you need a trail: who asked, what was retrieved, what was answered — not for reporting, but for reconstructing a specific incident when it's time to figure out whether a disclosure was a configuration error or a one-off failure. And a separate question is where the index physically lives — a public cloud, a private cloud, or fully on-premise — which is also a matter of access policy, not just an infrastructure choice.
In Knovium, the contract scenario is closed at the architecture level: role-based access control (RBAC) is applied before retrieval, so the model physically cannot see documents outside a user's rights, instead of "seeing them but promising not to show them". Every query, the retrieved sources, and the final answer are logged, and deployment can be fully on-premise wherever company policy requires it.