RAG is useful when people need answers from documents they already have rights to see. It is dangerous when the index ignores those rights, when prompts can pull neighbouring chunks, or when nobody can explain what the model was allowed to read.
Start with the corpus. Which shares, sites and systems? Who owns retention? Can you delete a document and have it leave the index? If you cannot answer those, do not connect a model yet.
Access control must be enforced at retrieval time, not only at the chat UI. If the search layer can return a chunk from a folder the user cannot open, you have built a bypass. Entra groups, ACL expansion, and document-level permissions are unglamorous and non-negotiable.
Logging belongs in the design: who asked, which documents were retrieved, which model ran, where the answer went. Legal and security will ask. Build the trail while the system is small.
A safe first system is narrow: a well-owned policy library, or a runbook set, with a human still responsible for actions. Do not point a general assistant at every file share and call it an AI strategy. That is how confidential HR folders end up in a demo.
All technical perspectives