When access is revoked, how fast does RAG forget?

An interactive reference design for permission-aware retrieval that measures how long a revoked share or group membership keeps reaching answers. A reference design, not deployed as described. Click any node for responsibilities, tech, controls, a worked example, cost and fallback. Read the article.

Question / answer Authoritative source Permission sync Index & identity cache Deny-first overlay Query-time trimming Assurance

Controls Server-side groups Deny-first overlay Short TTL Fail closed Time-to-revoke SLO Oversharing scan

01 / 07

Reference deployment: Microsoft Entra ID · Microsoft Graph notifications + delta · Azure AI Search security filters · SharePoint ACLs · deny-first overlay · canary SLO Atiqul Islam · atiqulislam.dev

Each node: responsibilities, tech & standards, controls, cost and fallback, plus a worked example of A and B asking the same question. Budget figures (P, T, the 15-minute target) are assumptions, not measurements. Switch to Vertical 9:16 to screen-record.

PNG Static diagram Index All reference architectures