Production RAG: authorization, hybrid search, and grounding
Retrieve only information the user is allowed to receive.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Retrieve only information the user is allowed to receive.

Visual description:
Retrieve only information the user is allowed to receive.

00:00:06.375 — The idea

Enforce access rules before restricted content reaches the model. Check answer citations against the sources actually supplied. Instructions inside a document do not grant permission.

Visual description:
Enforce access rules before restricted content reaches the model. Check answer citations against the sources actually supplied. Instructions inside a document do not grant permission.

00:00:21.417 — One useful term

Authorized retrieval. Fetching information only within the requester’s permitted access.

Visual description:
Fetching information only within the requester’s permitted access.

00:00:30.125 — A worked example

Two users have different access to a shared collection. Search filters by permission before scoring. A poisoned document asks for another user’s record, but that instruction cannot expand access.

Visual description:
Two users have different access to a shared collection. Search filters by permission before scoring. A poisoned document asks for another user’s record, but that instruction cannot expand access.

00:00:45.958 — Your turn to think

Is filtering the final answer enough if restricted text already reached the model? Pause and decide before continuing.

Visual description:
Is filtering the final answer enough if restricted text already reached the model?
Pause the video if you need more time.

00:01:04.208 — Why this answer works

No. Protect the earlier data boundary. Reject citations to sources that were not validly retrieved.

Visual description:
No. Protect the earlier data boundary. Reject citations to sources that were not validly retrieved.

00:01:14.500 — Check 1

Filter access before generation.

Visual description:
Filter access before generation.

00:01:19.667 — Check 2

Check citation IDs and supporting passages.

Visual description:
Check citation IDs and supporting passages.

00:01:25.708 — Check 3

Stop and repair any information leak.

Visual description:
Stop and repair any information leak.

00:01:31.167 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.