Blog

Permission staleness in AI retrieval: what sync-then-filter costs you, and when it does not matter

A where clause built from the caller's groups is the right primitive, and the easy half. The hard half is what happens beneath it as your organisation changes.

We looked for the benchmark behind our own latency figure and found none. Measuring properly started at 302ms p95 and ended at a public 16ms p50 / 21ms p95.

Gateco is in the Okta Integration Network. Install the app from the OIN catalog and provision users and groups over SCIM 2.0, no custom SCIM app required.

Purview classifies, labels, and governs your data estate. It does not decide, at query time, whether a user may retrieve a document from AI you build.

Law firms are putting AI over matter documents. Here is how to enforce ethical walls, privilege, and conflicts screening at the retrieval layer with Gateco.

A RAG pipeline can enforce access inside the vector query or in the app after results return. Each has a distinct failure mode. Here is what breaks.

Embeddings throw away the permissions your source systems already track. Here is the recipe to carry document-level permissions into a RAG pipeline.

Gateco supports role, attribute, and relationship-based access control, and you can mix them in one policy set. Here is which model fits which pattern.

Gateco is not a RAG framework. It is the authorization layer you insert at the retrieval step of LangChain or LlamaIndex. Here is where it goes, and why.

An orchestrator decides which agents and steps run. Gateco decides what an agent can retrieve. Different layers, and retrieval is where RAG leaks.

August 2, 2026 is the EU AI Act deadline. If your RAG pipeline touches Annex III high-risk use cases, here is the practical seven-item checklist.

Gateco now supports per-org OpenAI keys for Grounded Answers, encrypted with AES-256-GCM and per-tenant KMS binding. Here is how the credit model works.

When policy evaluation hits an error, Gateco denies the retrieval and logs it. Here is why fail-closed is the right default, and when fail-open fits.

Google has two retrieval products under the Vertex AI brand: Vector Search, a managed ANN index, and Vertex AI Search, Discovery Engine. When to use each.

The Gateco MCP server gives Claude Desktop, Cursor, and any MCP host policy-enforced access to your vector knowledge bases. Denied content never surfaces.

Gateco now supports 1-hop relationship-based access control: policies can check whether a principal owns or is assigned to a resource. How and when to use it.

IAM authenticates the agent. Gateco authorizes the data. Why one IAM role is not enough when your chatbot serves thousands of users, and how to fix it.

August 2, 2026 is the EU AI Act deadline for high-risk AI. If your RAG pipeline touches employment, credit, or healthcare decisions, you are in scope.

Cerbos is a generic authorization engine. Gateco is a retrieval-specific security layer for RAG. They solve different problems, and can be used together.

pgvector Row Level Security is the most common DIY RAG auth pattern. When it works, when it breaks, and the five triggers that make teams outgrow it.

Every RAG pipeline your team ships creates an access surface that bypasses application-layer authorization. Here is how to close the gap, in security terms.

How much latency does an authorization layer add to RAG? A public benchmark: 16ms p50 and 21ms p95 policy overhead, and what drives variance by connector.

A summary of everything that shipped this month: relationship-based access control, API key authentication, SDK v1.0, and our new Trust Center.

Gateco enforces the same deny-by-default policies across AWS OpenSearch, Azure AI Search, and Google Vertex AI, so RAG governance stays consistent everywhere.

Gateco now integrates with Google Vertex AI Vector Search and Vertex AI Search, bringing deny-by-default retrieval, ABAC policies, and audit trails to GCP.

Azure AI Search gives you hybrid retrieval. Gateco decides who can see the results. Why enterprise RAG needs both, and how they compose.

Azure AI Search has powerful retrieval, but for compliance it leaves three gaps: no dynamic ABAC, no deny-by-default, and no audit trail.

Azure AI Search is a managed search platform; pgvector, Pinecone, and Qdrant are retrieval primitives. The choice shapes your RAG architecture and governance.

A step-by-step guide to connecting your identity provider to Gateco for policy-enforced AI retrievals.

Gateco now supports four distinct retrieval modes. Here's when to reach for each one, and why hybrid might be your new default.

Metadata filters are the most common approach to RAG access control, and fundamentally insufficient. Why they can't replace a dedicated permission layer.

Four approaches to RAG authorization compared: no auth, metadata filters, app-layer RBAC, and a dedicated permission layer. Pros, cons, and when each fits.

DIY RAG authorization needs a policy engine, metadata resolution, audit logging, connector adapters, and identity sync. What it actually takes to build it.

Vector databases retrieve by embedding similarity. They don't know who's asking or check permissions. That is the RAG security gap, and it is wide.

We're launching Gateco, the security middleware between AI agents and organizational knowledge: deny-by-default retrieval, 12 connectors, and audit trails.

Gateco assigns each connector a readiness level from L0 to L4, based on security capability rather than a percentage. Here is what each level means.

Gateco resolves policy metadata via a configurable 3-step hierarchy: sidecar, inline, or SQL views. Here is when to use each.

Install the Python SDK, connect a vector database, create a policy, and run your first permission-aware retrieval. With actual code that runs.

The Access Simulator dry-runs policy evaluation so you see exactly what a principal would be allowed or denied before activating policies. How to use it.

When auditors ask who accessed what data through your AI system, you need an answer. Gateco's audit trail covers 50+ event types across every operation.

Financial services face unique RAG challenges: information barriers, SOX compliance, and classification-based access to market-sensitive data. How Gateco helps.

Healthcare RAG must protect PHI at every retrieval. Gateco's ABAC policies, classification-based access, and audit trails support HIPAA minimum necessary.

SaaS platforms with LLM features must prevent cross-tenant leakage in shared RAG infrastructure. How to enforce tenant isolation at the retrieval layer.