Study proposes authorization-first retrieval to curb structural leaks in multi-agent RAG systems

[TechRxiv] Rohith Namboothiri proposes Authorization-First Retrieval (AFR), an architectural invariant requiring that authorization constrain the retrieval candidate set before any learned component consumes retrieved content, according to a preprint. In a controlled corpus of 43 chunks across 28 documents with role-scoped rules spanning five enterprise roles, three sensitivity levels and four domains, the author reports that retrieve-then-filter pipelines exposed unauthorized context in 96.8% of 93 structured queries covering six attack categories and violated authorization correctness on 100% of queries that should be denied, while AFR eliminated all structural leaks (0/93) and all answer leaks (0/93). A chunk-size sweep across five granularities confirmed AFR held invariant to chunking strategy, while retrieve-then-filter leakage rose monotonically with chunk size, the author said. The author identifies parametric knowledge leakage as a fundamental boundary on what retrieval architecture can guarantee. The work is a preprint and has not been peer reviewed.