Promptis — Permission-Aware RAG Assistant
A RAG knowledge assistant enforcing pre-retrieval permission filtering over PostgreSQL/pgvector and ltree, solving recall collapse and unauthorized token disclosure in multi-tenant systems.
Problem
In enterprise Retrieval-Augmented Generation (RAG), documents belong to organizational hierarchies with complex access-control lists (ACLs). A standard vector database search matches embeddings purely on semantic similarity without awareness of user clearance. Teams typically address this with two naive patterns:
- Prompt-Level Filtering (Soft Boundaries): Dumping unfiltered chunks into the prompt with instructions like "Only answer if the user is cleared." This violates basic security boundaries—restricted tokens enter the model context, where prompt injection or stochastic synthesis can extract them.
- Application-Level Post-Filtering (In-Memory Stripping): The app queries the vector database for
top_k = N, retrieves the results, and discards unauthorized rows in Node.js or Python memory before prompt assembly.
While in-memory post-filtering prevents data leakage into the prompt, it suffers from a fatal retrieval failure: Recall Collapse (Context Starvation). If an employee asks a question where the 5 most semantically similar chunks belong to restricted executive documents, the in-memory filter strips all 5. The LLM receives 0 context chunks, even if dozens of valid, authorized documents exist further down the index at ranks 6 through 50.
Architectural Decisions
Pre-Retrieval Query-Level Filtering
To eliminate recall collapse, authorization must occur inside the database query engine during index traversal, before any candidate chunks are returned to application memory.
We structured the retrieval engine to execute vector similarity queries with inline SQL authorization constraints over PostgreSQL with pgvector. By embedding the user's clearance predicate directly into the vector index scan, the database guarantees that every single slot in the requested top_k is filled exclusively with authorized documents.
Hierarchical Access Control with PostgreSQL ltree
Organizational structures are trees (e.g., org_a.engineering.platform.infra). Evaluating complex permission paths using relational joins or string matching (LIKE 'prefix%') degrades significantly as hierarchy depth increases.
We adopted PostgreSQL's native ltree data type and GiST indexing. Using the ancestor operator (<@), the database prunes entire unauthorized branch subtrees at the index level. In benchmarks across 115,301 sentence chunks, ltree matched string prefix matching at shallow depths and outperformed it by 5.0x at depth 10 (0.30 ms vs. 1.50 ms p95 latency).
Split Control Plane vs. Self-Hosted Data Plane
Enterprise data sovereignty requirements forbid sending raw corporate documents to third-party multi-tenant SaaS providers. We architected Promptis with a strict plane separation:
- Control Plane: Manages authentication, model routing, token usage tracking, and RAG orchestration metadata.
- Data Plane: Runs self-hosted within the customer's private VPC (PostgreSQL, pgvector, chunk storage in Backblaze B2/S3), ensuring embeddings and raw text never leave their sovereign infrastructure.
Key Challenges & Technical Essay
The primary technical hurdle was understanding pgvector HNSW index mechanics. When applying strict WHERE clauses on vector queries, naive HNSW index scans can terminate early if candidate nodes visited during graph traversal fail the filter condition. We tuned index parameters (hnsw.ef_search) and iterative scan configurations to guarantee high recall without incurring full-table sequential scan penalties.
The complete architectural analysis, index mechanics, and benchmarking tables are published in our technical essay: Securing Multi-Tenant RAG: Recall Collapse, pgvector Filtering, and PostgreSQL ltree →
Outcomes
Promptis was completed as an engineering Final Year Project (FYP) at the University of Engineering & Technology (UET) Peshawar, built entirely solo from data modelling through Next.js frontend and Express/PostgreSQL backend.
It demonstrated that pre-retrieval hierarchical filtering is the only robust mechanism to guarantee both 100% token isolation and zero recall collapse in multi-tenant RAG systems.