Local RAG on a shared drive can accidentally become everyone sees everything if you only think about embeddings. Access control belongs in the design, not as a patch after a scare.
Separate indexes when needed
If finance and engineering should not read each others files, do not build one happy index across both. Separate corpora, separate embeddings stores, and separate bot endpoints—or enforce filtering with a source-of-truth ACL checked at query time.
Ingestion hygiene
Only service accounts with least privilege should crawl files. Skip personal folders and directories marked private. Record what was ingested and when so you can delete vectors when a document is withdrawn.
Query-time checks
Even with separate indexes, verify the requesting user may see a chunks source path before returning it to the model. Log denials. Prefer showing citations the user can open over mystery paragraphs.
Governance
Write a one-page policy: who can add sources, who can approve a new collection, how long chat logs live. Point employees to norms adapted for your company, and keep technical how-tos under your internal wiki plus public orientation at solutions and basics. For architecture conversations, inquiry is a contact path. Also see community rules for sharing discipline. Retrieval quality means little if the wrong person retrieved it.
Closing checklist
Before go-live: confirm a user without access cannot elicit restricted chunk text, confirm deletion of a source removes it from answers after re-index, and confirm logs capture enough to audit without storing unnecessary raw secrets. Repeat after each new data collection is added.
Extended incident story pattern
When a document is shared too widely in the index, treat it like an ACL bug on a file server: remove access, re-index or purge vectors, notify affected owners, and write a postmortem with one preventive change. Do not rely on the model should refuse. Refusal is probabilistic; ACL checks are deterministic. Mixing those layers without clarity is how quiet leaks happen. Schedule a quarterly access review the same way you already review shared drive permissions.
Published by MicroAI One (本地AI 1号网), a Shenzhen team working on local LLM hardware, software and deployment.