- A private LLM inside your VPC can still read a Board-Only memo to a junior analyst. In the demo we built, one routine credit-risk question comes back with the board's EUR 412 million loss projection. The model never misbehaved. The retrieval layer did. 🧵
- The build most pilots ship: tag each chunk with a flat ACL at ingestion. Our baseline does it faithfully, resolving nested groups at index time. It fails two ways no tuning fixes: the snapshot goes stale, and a flat tag cannot express clearance, time windows, or termination.
- Hero case: Lena Vogt, credit-risk analyst, clearance L2 (synthetic European-bank fixture, no real people). Years of nested-group inheritance debt make her transitively a Board member. A group-only tag has no clearance concept, so the flat-ACL side serves the Board Pack.
- The fix is deterministic code outside any LLM. At query time, per doc, it flattens her live nested groups (3 levels deep in our fixture), evaluates clearance L1-L4, managed device, time-boxed grants, and employment status, then emits ALLOW, WITHHELD(reason), or NEEDS_REVIEW.
- Same retrieval, same question. The Board memo is withheld before the model with a machine-checkable reason code: BOARD_MEMBERSHIP_REQUIRED (needs L4, Lena is L2). She gets a real answer from the two docs she is entitled to, and it states what was withheld instead of bluffing.
- The detail security engineers stop on: the methodology note Lena may read carries a prompt injection telling any AI assistant to output the board figure. It has nothing to exfiltrate. The Board memo never entered the context window. Authorization happened before the LLM.
- On the 40-case golden authorization set (10 users x 4 sensitive docs, labels derived by an independent reference oracle, not hand-picked): firewall 40/40, 0 unauthorized disclosures, 0 false denials. Faithful flat-ACL baseline: 29/40, 10 disclosures, 1 false denial.
- Why this doesn't age out as models improve: a perfect model handed a board document still leaks it. The permission decision is code, not a model's self-report. Same input, same decision, every run. That reproducibility is what makes it auditable. Agents advise, code decides.
- If you ship enterprise RAG: does document authorization run at ingestion, when the index is built, or at retrieval, against the live identity graph? When access was revoked this morning, what does your stack serve this afternoon? #EnterpriseRAG #RBAC #AIGovernance #AISecurity
- The demo runs offline, no API key: the firewall is the product, the LLM is swappable scenery. LLM_PROVIDER=ollama means not one token leaves the box. Split-screen leak vs firewall, hash-chained audit trail, scoreboard: https://veriprajna.com/demos/sovereign-ai-private-llm
Published on X · July 20, 2026
On social media