Structural Gaps in Access Control for AI Agent RAG Systems

As enterprise AI agents become increasingly prevalent, a structurally overlooked vulnerability in access control for Retrieval-Augmented Generation (RAG) systems has been confirmed through a concrete case study. Egiziago Cioffi, CEO of Microsoft partner firm SynSphere Italia based in Milan and an IT architect, developed an Azure OpenAI email assistant capable of automatically processing approximately 60% of incoming emails. The evaluation score was positive and it passed internal testing, but a subsequent verification revealed a critical vulnerability.

When Cioffi queried the assistant using a low-privilege account, he discovered that the response included content from SharePoint documents that the account should not have direct access to. The results from high-privilege and low-privilege account queries were identical. This revealed that the assistant was retrieving and responding to information using the service account's permissions at the time of indexing, rather than the requesting user's permissions. The evaluation scores and unit tests did not include the perspective of 'whose authority determines what information is returned.'

RAG is a mechanism that allows AI to search external data such as company documents in real-time and incorporate them into responses, rather than relying solely on knowledge learned in training. If access controls based on 'who asked the question' do not function at the search stage, there is a risk of sensitive information being delivered to unauthorized users. Microsoft's Azure AI Search began offering document-level access control functionality starting with its May 2025 preview, with integration to SharePoint access rights added in subsequent previews. However, this functionality is not guaranteed to work effectively across all usage pathways.

According to Microsoft's official documentation, in 'Azure OpenAI On Your Data,' if fields managing document access rights are not configured correctly, document-level access control is disabled. In other words, when configuration is incomplete, access restrictions enter an 'open state,' creating a structure where security gaps easily occur unintentionally. Cioffi's system adopted a custom pipeline that bypassed Azure AI Search, and permission checks at query execution would not function unless developers implemented them independently.

Data exists showing this problem extends beyond an individual case. AI security company Straiker published its STAR Labs threat report in July 2025. According to the report, of over 1,700 attack experiments conducted against business AI agents, 91% of successful attacks resulted in covert data exfiltration without using malware or lateral movement within networks. The characteristic feature is that since the agent itself returns information, traditional attack methods are unnecessary.

What this series of facts demonstrates is a structural challenge: evaluation criteria for AI agents tend to focus on 'whether they can answer accurately,' while the access control perspective of 'what should be answered to whom' easily takes a back seat. When enterprises deploy RAG-based agents to production environments, access control verification should be performed with equal or greater importance than functional testing. Going forward, the approach of 'security by design'—incorporating access control from the technology selection and architecture design stages—is expected to gain increasing importance in AI agent development. The practical implications for enterprises are clear. Even if evaluation scores are positive, this alone is insufficient; on-site verification using accounts with different permission levels is essential. Additionally, confirming at the log level that permission checks are actually functioning, based on understanding the configuration specifications of the services used, is a prerequisite for safe operations. As AI agent adoption accelerates, whether security verification becomes a standard part of development and operation processes will be one of the key points to watch going forward.