Horizontal RAG Chunk Traceability for Department Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing horizontal Retrieval Augmented Generation (RAG) systems lack mechanisms to control access to specific document chunks, leading to unauthorized access by users due to obliviousness to user access rights, thereby limiting their functionality and value.
Innovation Solution
Implementing chunk traceability and user-based access control by maintaining access permissions, tracing document chunk lineage, and excluding unauthorized chunks based on user rights, ensuring only authorized content is accessed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a horizontal RAG system is fed with documents relevant to one department, then the system can provide department-specific information, but users from other departments may gain unauthorized access to those documents
Solution Approach 1:
The patent segments the document collection into department-specific subsets by organizing documents with metadata indicating their departmental affiliation. The RAG system then segments the retrieval process to query only relevant departmental document subsets based on user identity, ensuring that finance department documents are separated from engineering department documents and only accessible to authorized users from the respective departments.
Solution Approach 2:
The patent introduces an intermediary access control layer between the user and the document retrieval process. This intermediary component intercepts retrieval requests, identifies the user's departmental permissions, and filters or redirects the query to appropriate document subsets. The intermediary ensures that even though the horizontal system contains all departmental documents, unauthorized users cannot access documents outside their department through this mediating control mechanism.
2Productivity
If existing similarity search techniques are used in horizontal RAG systems, then the system can retrieve relevant document chunks, but the system becomes oblivious to user access rights and may provide unauthorized access
Solution Approach 1:
The patent performs preliminary actions by pre-organizing documents into departmental subsets with appropriate access control metadata before the retrieval process begins. User permissions and document restrictions are pre-configured and stored as structured data. When a retrieval request occurs, the system already has the framework in place to efficiently filter documents based on user credentials without adding complex real-time access control logic during the similarity search process itself.
Solution Approach 2:
The patent implements a universal access control framework that works across all departmental document subsets simultaneously. The same access control mechanism and permission checking logic are applied universally to finance, engineering, marketing, and other departmental documents. This multi-functional approach allows a single horizontal RAG system to serve multiple departments with different access requirements using one unified access control implementation rather than separate systems for each department.
3Ease of manufacture
If a horizontal RAG system uses generic documents accessible to all users, then the system is simple to implement, but it lacks department-specific data sets and reduces functionality and value
Solution Approach 1:
The patent applies local quality by assigning different access permissions and document subsets to different user groups based on their departmental affiliations. Instead of making the entire document collection uniformly accessible or uniformly restricted, the system configures specific local access rules for each department. For example, finance documents have finance department access permissions, while engineering documents have engineering department permissions, creating locally optimized access control that matches departmental needs while maintaining overall system simplicity.
Data Source
AI summary
In one implementation, a device may maintain access permissions that control whether a user is allowed to access a particular document. The device may match a plurality of document chunks from a retrieval augmented generation system to a prompt issued by the user for input to a language model. The device may form, based on the access permissions, a modified set of document chunks by excluding a particular document chunk from the plurality of document chunks based on the particular document chunk having a data lineage from the particular document. The device may augment the prompt using the modified set of document chunks prior to input to the language model.