A paragraph of body copy.
The pattern is familiar by now. A retrieval-augmented pilot dazzles in the demo, the business signs off, and then the security review begins. Three months later the project is quietly shelved. The model was never the problem. The architecture was.
The three questions that kill pilots
Every serious security team asks the same three questions. Who can see which documents through the retrieval layer? Where does the data go when it leaves the vector store? And what is the audit trail when the system asserts something false?
Most pilots cannot answer any of them, because retrieval was built as a single shared index with no notion of the permission model that already governs the underlying documents. The demo works precisely because it ignores the controls production would require.
Design the review in, not around
The fix is architectural and it is boring: document-level ACLs enforced at retrieval time, not filtered afterwards. Embeddings and indexes living inside your tenancy. Query and response logging with document provenance attached to every generated claim.
If your RAG system cannot say which document justified a sentence, it is not ready for the enterprise, no matter how good the answers feel.
None of this is exotic. It is the same discipline access control has always demanded, applied to a new retrieval path. Teams with a software engineering background do it by reflex; teams that started from the model tend to discover it in review, when the cost of retrofit is highest.
Build for the security review from the first sketch and the pilot-to-production gap mostly disappears. That is not an AI insight. It is an engineering one.