# Two-user RAG access control test plan

Proposed non-production test. Use synthetic content and authorised accounts. No results are supplied.

Source system/connector revision: [value]. Supported read-permission types: [list]. Unknown/unsupported rules: exclude from corpus. Identity issuer/user/group mapping: [reference]. Retrieval/index/model/cache versions: [values]. Owners: source [role], identity [role], platform [role], reviewer [role].

## Fixtures and expectations

Doc A: visible only to A, unique synthetic marker A. Doc AB: visible to A and B, unique marker AB. Doc B: visible only to B, unique marker B. Record effective source permissions before each case.

| Case | Expected | Source-change/detection/first-denial times | Actual result/evidence |
| --- | --- | --- | --- |
| A and B request their permitted documents | Relevant permitted content | Not applicable | Not run |
| A requests B / B requests A | Deny content, titles, previews and citations | To record | Not run |
| Direct grant removed / group membership removed | Block under the agreed freshness rule | To record | Not run |
| File moved between inherited-permission folders | Match supported effective source rights | To record | Not run |
| Client spoofs identity / omits access filter | Trusted backend still enforces scope | To record | Not run |
| Permission lookup fails / permission changes during generation | Fail closed; test streaming boundary explicitly | To record | Not run |
| Citation, preview or download requested directly | Recheck current access | To record | Not run |
| Cached answer/history/derived summary reused after revocation | Recheck contributing-source access | To record | Not run |
| Old index restored after revocation/deletion | Reconcile current rights/deletions before serving | To record | Not run |

Inspect retrieval trace, model input and final output for every restricted marker. Keep test evidence restricted; avoid copying real confidential data into logs. Disable shared restricted-response caching until a correct scoping/invalidation design is demonstrated.

Permitted synchronisation delay and rationale: [explicit value/decision]. Passing rule: every defined denial case blocks disclosure; authorised controls remain useful. Record denominators and failures. Stop after any unauthorised disclosure. Disable restricted retrieval and return to the source system/common-access corpus while correcting failures. Previously viewed or exported information cannot be recalled by these controls.