Enterprise RAG with access control.
A retrieval-augmented system is only as private as its retriever. The usual design indexes everything, retrieves whatever is closest to the question, and asks the model to be careful about what it repeats. That is not access control. It is a request, and the first well-phrased question gets past it.
Yohanun makes the decision before generation. Every piece of memory carries labels; who is cleared for what is a ledger the platform holds; the two are compiled into the vector query itself. Material the asker may not see is never a candidate, so there is nothing for a prompt to extract. The model is never the gatekeeper.
What the gate expresses
Compartments and classification
A matter, a deal, a case: memory labelled with a compartment is returned only to a principal cleared for it, at or above its classification. A tenant can insist every write names its compartment, so nothing is public by accident.
A platform-held clearance ledger
Grants and revocations are append-only rows, effective on the next request. Once a principal is in the ledger, nothing the calling application asserts about them is believed. Grants are checked against a conflict graph, and a refused grant is recorded. If the ledger cannot be read, the gate fails closed to public material.
Owner walls and custody
A memory can belong to a person, or to several. Holding is separate from owning: custody keys move by ledger row, so an agent is retired or a matter handed over without rewriting a single memory.
Verified identity
Who is asking can be the subject of a token your own identity provider signed, checked by the platform against your JWKS. A field naming someone else is ignored; no valid token, no read, never a fallback.
Answers inherit the wall
A stored answer carries the most sensitive compartment, the highest classification and the owners common to every source it drew on; where no key covers them all it belongs to the asker alone, and the response says so. Labels a consumer adds can narrow a turn, never widen it.
The full mechanism, with the request shapes: Access control in retrieval.
The two questions a security review asks
What did the model see? Every gated read writes one row before the answer returns: who asked, what clearance applied, what was surfaced. A tenant can require that a read without a record is refused. Every answer carries a sources verdict naming what grounded it, stamped on the stored turn so it outlives the connection.
Can you erase it, and prove it? Ordinary operation never destroys anything. Erasure is one governed path: a content-free plan, a mandate or a named second person approving exactly that plan, destruction across every store, the asker's own words scrubbed from the logs, one tombstone per memory, and a receipt that says what was not reached (backups, with their expiry window).
Details: Audit trail per read. The platform's own list of refusals, each testable: What Yohanun will not do.
Your model, your infrastructure
The gate, the ledger and the record sit below the model and do not care which one answers. Use the platform's metered models, bring your own provider key, or point a self-hosted deployment at a model on your own network so nothing leaves it for generation. Model-agnostic is the condition that makes a governed deployment credible, not a convenience.
See it in six requests, wall and audit row included: the quickstart. For a deployment conversation, the enterprise page.
Talk to us