Latest7 min read
Pre-Retrieval vs Post-Retrieval Authorization
A RAG pipeline can enforce access inside the vector query or in the app after results return. Each has a distinct failure mode. Here is what breaks.
Read full article →Blog
Insights on AI retrieval security, RAG authorization, and data governance.
All postsindustrycompliancelegalreference-architecturearchitecturesecurityragengineeringpolicyproductcomparisoneu-ai-actregulationenterprisegcpgetting-startedrebacagentsauthorizationai-securitypostgresperformanceapi-keysmulti-cloudazureawsvertex-aiidentityretrievalsearchlaunchtechnicalintegrationtutorialpro-featurefinancial-serviceshealthcaresaas
8 min readGateco Team
How to Enforce Document-Level Permissions in Enterprise RAG
Embeddings throw away the permissions your source systems already track. Here is the recipe to carry document-level permissions into a RAG pipeline.
Read more →7 min readGateco Team
RBAC, ABAC, or ReBAC: Which Access Model to Use
Gateco supports role, attribute, and relationship-based access control, and you can mix them in one policy set. Here is which model fits which pattern.
Read more →6 min readGateco Team
AI Orchestrators vs Gateco: Workflow vs Retrieval Control
An orchestrator decides which agents and steps run. Gateco decides what an agent can retrieve. Different layers, and retrieval is where RAG leaks.
Read more →6 min readGateco Team
BYOK: Per-Org LLM Keys and KMS Encryption
Gateco now supports per-org OpenAI keys for Grounded Answers, encrypted with AES-256-GCM and per-tenant KMS binding. Here is how the credit model works.
Read more →5 min readGateco Team
Why Gateco Denies on Policy Errors, and When to Change It
When policy evaluation hits an error, Gateco denies the retrieval and logs it. Here is why fail-closed is the right default, and when fail-open fits.
Read more →7 min readGateco Team
ReBAC in Gateco: Relationship-Based Access for Vector Retrieval
Gateco now supports 1-hop relationship-based access control: policies can check whether a principal owns or is assigned to a resource. How and when to use it.
Read more →7 min readGateco Team
The RAG Authorization Gap for Security Leaders
Every RAG pipeline your team ships creates an access surface that bypasses application-layer authorization. Here is how to close the gap, in security terms.
Read more →4 min readGateco Team
What Shipped in April 2026: REBAC, API Keys, and Trust Center
A summary of everything that shipped this month: relationship-based access control, API key authentication, SDK v1.0, and our new Trust Center.
Read more →6 min readGateco Team
Azure AI Search and Gateco: Better Together
Azure AI Search gives you hybrid retrieval. Gateco decides who can see the results. Why enterprise RAG needs both, and how they compose.
Read more →7 min readGateco Team
Why Azure AI Search Isn't Enough for Enterprise RAG Security
Azure AI Search has powerful retrieval, but for compliance it leaves three gaps: no dynamic ABAC, no deny-by-default, and no audit trail.
Read more →7 min readGateco Team
Setting Up Gateco with Your Identity Provider
A step-by-step guide to connecting your identity provider to Gateco for policy-enforced AI retrievals.
Read more →7 min readGateco Team
Why Metadata Filters Aren't Enough for RAG Security
Metadata filters are the most common approach to RAG access control, and fundamentally insufficient. Why they can't replace a dedicated permission layer.
Read more →8 min readGateco Team
Authorization Approaches for RAG Systems: A Comparison
Four approaches to RAG authorization compared: no auth, metadata filters, app-layer RBAC, and a dedicated permission layer. Pros, cons, and when each fits.
Read more →6 min readGateco Team
The RAG Security Gap: Similarity Is Not Authorization
Vector databases retrieve by embedding similarity. They don't know who's asking or check permissions. That is the RAG security gap, and it is wide.
Read more →Ready to secure your AI retrievals?
Get started with Gateco in minutes. Free tier includes 100 secured retrievals per month.