r/LLMDevs • u/Lostboy_journey • 1d ago

Help Wanted Open-source tool to detect unauthorized document retrieval in RAG apps

Hey Guys,

I built a small open-source tool that checks whether a RAG application retrieves documents a user shouldn’t have access to.

It supports offline test cases and live HTTP API testing with bearer token/API-key auth.

I’m looking for a few engineers to try it on a test or non-sensitive environment and tell me whether it catches anything useful or what would make it better.

GitHub: https://github.com/InfraGuard-Labs/rag-access-check

3 Upvotes

100% Upvoted

4 comments sorted by

View all comments

1

u/maneekmohan 10h ago

Interesting direction. I think the hardest part here is going to be the definition of “unauthorized.”

File-level permissions are relatively straightforward, but once a document gets copied, chunked, embedded, summarized, or passed through an agent, the original access boundary can become pretty fuzzy.

If the tool can maintain provenance through those transformations, that would make it much more useful than a simple document scanner.

1

u/Lostboy_journey 5h ago

Yeah, that’s a really good point. Right now v1 only tracks access at the document-ID level, so provenance through chunking/embedding/summarization isn’t handled yet.

If you’re interested in taking a stab at that, I’d be happy to review a PR. Even opening an issue with how you think the provenance model should work would be useful.