Your RAG Stack Knows Who You Were This Morning
Permission staleness in AI retrieval: what sync-then-filter costs you, and when it does not matter
September 29, 2026·8 min read
architecture
20 posts
A Filter Is Not an Authorization System
A where clause built from the caller's groups is the right primitive, and the easy half. The hard half is what happens beneath it as your organisation changes.
September 1, 2026·6 min read
Pre-Retrieval vs Post-Retrieval Authorization
A RAG pipeline can enforce access inside the vector query or in the app after results return. Each has a distinct failure mode. Here is what breaks.
June 21, 2026·7 min read
AI Orchestrators vs Gateco: Workflow vs Retrieval Control
An orchestrator decides which agents and steps run. Gateco decides what an agent can retrieve. Different layers, and retrieval is where RAG leaks.
June 18, 2026·6 min read
Why Gateco Denies on Policy Errors, and When to Change It
When policy evaluation hits an error, Gateco denies the retrieval and logs it. Here is why fail-closed is the right default, and when fail-open fits.
May 22, 2026·5 min read
Vertex AI Search vs Vertex AI Vector Search
Google has two retrieval products under the Vertex AI brand: Vector Search, a managed ANN index, and Vertex AI Search, Discovery Engine. When to use each.
May 19, 2026·6 min read
Why your AI agent needs more than an IAM role
IAM authenticates the agent. Gateco authorizes the data. Why one IAM role is not enough when your chatbot serves thousands of users, and how to fix it.
May 13, 2026·8 min read
Cerbos vs Gateco: Generic Policy Engine vs Vector-DB-Native
Cerbos is a generic authorization engine. Gateco is a retrieval-specific security layer for RAG. They solve different problems, and can be used together.
April 28, 2026·7 min read
Why pgvector RLS Breaks Past Ten Tenants
pgvector Row Level Security is the most common DIY RAG auth pattern. When it works, when it breaks, and the five triggers that make teams outgrow it.
April 25, 2026·6 min read
The RAG Authorization Gap for Security Leaders
Every RAG pipeline your team ships creates an access surface that bypasses application-layer authorization. Here is how to close the gap, in security terms.
April 22, 2026·7 min read
Measuring Gateco Policy Overhead: 16ms p50, 21ms p95
How much latency does an authorization layer add to RAG? A public benchmark: 16ms p50 and 21ms p95 policy overhead, and what drives variance by connector.
April 18, 2026·6 min read
Multi-Cloud RAG Governance Across AWS, Azure, and GCP
Gateco enforces the same deny-by-default policies across AWS OpenSearch, Azure AI Search, and Google Vertex AI, so RAG governance stays consistent everywhere.
April 26, 2026·7 min read
Azure AI Search and Gateco: Better Together
Azure AI Search gives you hybrid retrieval. Gateco decides who can see the results. Why enterprise RAG needs both, and how they compose.
April 17, 2026·6 min read
Azure AI Search vs. Vector Databases for RAG
Azure AI Search is a managed search platform; pgvector, Pinecone, and Qdrant are retrieval primitives. The choice shapes your RAG architecture and governance.
April 17, 2026·10 min read
Why Metadata Filters Aren't Enough for RAG Security
Metadata filters are the most common approach to RAG access control, and fundamentally insufficient. Why they can't replace a dedicated permission layer.
March 17, 2025·7 min read
Authorization Approaches for RAG Systems: A Comparison
Four approaches to RAG authorization compared: no auth, metadata filters, app-layer RBAC, and a dedicated permission layer. Pros, cons, and when each fits.
March 14, 2025·8 min read
Building Custom RAG Authorization vs. Using Gateco
DIY RAG authorization needs a policy engine, metadata resolution, audit logging, connector adapters, and identity sync. What it actually takes to build it.
March 7, 2025·7 min read
The RAG Security Gap: Similarity Is Not Authorization
Vector databases retrieve by embedding similarity. They don't know who's asking or check permissions. That is the RAG security gap, and it is wide.
March 10, 2025·6 min read
Understanding Semantic Readiness: L0 Through L4 Explained
Gateco assigns each connector a readiness level from L0 to L4, based on security capability rather than a percentage. Here is what each level means.
February 10, 2025·7 min read
Multi-Tenant LLM Authorization for SaaS
SaaS platforms with LLM features must prevent cross-tenant leakage in shared RAG infrastructure. How to enforce tenant isolation at the retrieval layer.
February 14, 2025·7 min read