Your RAG Stack Knows Who You Were This Morning
Permission staleness in AI retrieval: what sync-then-filter costs you, and when it does not matter
September 29, 2026·8 min read
engineering
18 posts
A Filter Is Not an Authorization System
A where clause built from the caller's groups is the right primitive, and the easy half. The hard half is what happens beneath it as your organisation changes.
September 1, 2026·6 min read
Our Site Said "<25ms Overhead." We Could Not Prove It. Measuring Found Three Bugs.
We looked for the benchmark behind our own latency figure and found none. Measuring properly started at 302ms p95 and ended at a public 16ms p50 / 21ms p95.
August 23, 2026·8 min read
Pre-Retrieval vs Post-Retrieval Authorization
A RAG pipeline can enforce access inside the vector query or in the app after results return. Each has a distinct failure mode. Here is what breaks.
June 21, 2026·7 min read
How to Enforce Document-Level Permissions in Enterprise RAG
Embeddings throw away the permissions your source systems already track. Here is the recipe to carry document-level permissions into a RAG pipeline.
June 20, 2026·8 min read
RBAC, ABAC, or ReBAC: Which Access Model to Use
Gateco supports role, attribute, and relationship-based access control, and you can mix them in one policy set. Here is which model fits which pattern.
June 19, 2026·7 min read
Adding Gateco to a LangChain or LlamaIndex RAG Pipeline
Gateco is not a RAG framework. It is the authorization layer you insert at the retrieval step of LangChain or LlamaIndex. Here is where it goes, and why.
June 19, 2026·6 min read
AI Orchestrators vs Gateco: Workflow vs Retrieval Control
An orchestrator decides which agents and steps run. Gateco decides what an agent can retrieve. Different layers, and retrieval is where RAG leaks.
June 18, 2026·6 min read
Why Gateco Denies on Policy Errors, and When to Change It
When policy evaluation hits an error, Gateco denies the retrieval and logs it. Here is why fail-closed is the right default, and when fail-open fits.
May 22, 2026·5 min read
Vertex AI Search vs Vertex AI Vector Search
Google has two retrieval products under the Vertex AI brand: Vector Search, a managed ANN index, and Vertex AI Search, Discovery Engine. When to use each.
May 19, 2026·6 min read
Gateco MCP Server for Claude Desktop and Cursor
The Gateco MCP server gives Claude Desktop, Cursor, and any MCP host policy-enforced access to your vector knowledge bases. Denied content never surfaces.
May 15, 2026·6 min read
ReBAC in Gateco: Relationship-Based Access for Vector Retrieval
Gateco now supports 1-hop relationship-based access control: policies can check whether a principal owns or is assigned to a resource. How and when to use it.
May 10, 2026·7 min read
Cerbos vs Gateco: Generic Policy Engine vs Vector-DB-Native
Cerbos is a generic authorization engine. Gateco is a retrieval-specific security layer for RAG. They solve different problems, and can be used together.
April 28, 2026·7 min read
Why pgvector RLS Breaks Past Ten Tenants
pgvector Row Level Security is the most common DIY RAG auth pattern. When it works, when it breaks, and the five triggers that make teams outgrow it.
April 25, 2026·6 min read
Measuring Gateco Policy Overhead: 16ms p50, 21ms p95
How much latency does an authorization layer add to RAG? A public benchmark: 16ms p50 and 21ms p95 policy overhead, and what drives variance by connector.
April 18, 2026·6 min read
Azure AI Search vs. Vector Databases for RAG
Azure AI Search is a managed search platform; pgvector, Pinecone, and Qdrant are retrieval primitives. The choice shapes your RAG architecture and governance.
April 17, 2026·10 min read
When to Use Which Search Mode: Vector, Keyword, Hybrid, or Grep
Gateco now supports four distinct retrieval modes. Here's when to reach for each one, and why hybrid might be your new default.
March 27, 2026·6 min read
Building Custom RAG Authorization vs. Using Gateco
DIY RAG authorization needs a policy engine, metadata resolution, audit logging, connector adapters, and identity sync. What it actually takes to build it.
March 7, 2025·7 min read