Why does a RAG pipeline need authorization before retrieval rather than after?

A RAG pipeline needs authorization before retrieval because the model has no way of knowing what the person asking is allowed to see. If the retrieval layer can read every document in the store, the answer can quote any of them, and the permission check that would have happened when a user opened a file never runs. Filtering the query first means the model only works with that user's permitted subset. Access control for RAG and LLMs walks through the pattern.

What is a Cerbos query plan and how does it filter data for an AI application?

A Cerbos query plan is a set of conditions, derived from an authorization policy, describing which records a given user may access. You translate those conditions into your database query language and fetch only the permitted records in a single query, which is how an AI retrieval layer reuses the rules that already protect the rest of the application. More in filtering database results with query plans.

Can the same authorization policies cover both an application and its AI features?

The same authorization policies can cover both an application and its AI features, and reusing them is usually faster than writing a second set for the AI path. The rules that decide who sees a record can decide what a model retrieves, and the rules that decide who can issue a refund can decide whether an agent can. Keeping both paths on one policy set also means every decision produces one audit record of what was allowed and why.

Cerbos Included in the KuppingerCole Leadership Compass on Generative AI Defense

Q: Why does every AI agent tool call need its own authorization decision?

Every AI agent tool call needs its own authorization decision because the agent acts for a human who may be allowed to read a record but not change it. Authorizing the session once leaves a token with standing permissions that nobody narrows per request, so one overly broad grant reaches every system the agent can touch each time it runs. A per-call decision weighs the agent, the delegating human, the tool and the arguments. See MCP authorization.

Cerbos is included as a vendor in the KuppingerCole Leadership Compass on Generative AI Defense, published in December 2025.

Authorization is not the first control most teams reach for when they start defending a generative AI system, so it is worth being specific about where it belongs and what it stops.

Authorization has to happen before retrieval, not after the model answers

A model has no idea what the person asking is allowed to see. It answers from whatever data it can reach, so if the retrieval layer can read every document in the store, the answer can quote any of them. The permission check that used to happen when someone clicked a document does not happen at all.

That is why the check belongs in the retrieval layer, not after the model already has the data. The query gets filtered down to what this particular user is allowed to see, so the model only ever works with that subset. Query plans do that by turning a policy into a filter the data store can run, which is how your existing policies cover a RAG pipeline with nothing extra to maintain.

Every tool call an AI agent makes needs its own authorization decision

Retrieval is the easier half. An agent that calls tools changes data, spends money and talks to systems that were built for people. Each of those calls needs its own decision, because the agent may be acting for a user who is allowed to read a record but not refund it.

That means authorizing each tool call, not just the session the agent is running in. The decision has to consider the agent, the human who delegated the authority, the specific tool and the arguments being passed to it. Gateways and proxies in front of MCP servers are a sensible place to enforce that, as long as the decision comes from policy and not from code in the gateway. The alternative, where most agent deployments start, is a token with standing permissions that nobody narrows per request.

The reason this belongs in a defense report rather than an architecture one is the blast radius. One overly broad permission reaches every system the agent can touch, every time it runs, on a non-human identity that is rarely governed the way a human account is. What narrows it is the same authorization rules you apply to people, evaluated per request. Decisions made in one place also give you an audit record of what the agent was allowed to do and why.

Reuse the authorization rules you already have for the AI path

If you are adding AI features to an existing product, start from the rules you already have rather than writing new ones. The rules that decide who sees a record should decide what the model retrieves, and the rules that decide who can issue a refund should decide whether an agent can.

Try Cerbos to see how one set of policies on the Cerbos authorization management platform covers your application and your AI features, or book a call to talk through an agent deployment with our team.

Cerbos is included as a vendor in the KuppingerCole Leadership Compass on Generative AI Defense (Jonathan Care, December 2025). Source, KuppingerCole Analysts.