Your data says DENY.
Does your AI agree?
RAGFence tests whether AI assistants preserve the authorization boundaries of their underlying documents.
“What major strategic events are planned for Q4?”
“An acquisition is expected to close in October.”
Raven acquisition closes in October.
403 doesn’t exist for generated answers.
GET /salary Engineering 403 HR 200
Engineering asks:
"What does a Principal Engineer earn?"
AI → ???Once information is retrieved and rewritten by an LLM, an authorization failure no longer looks like an ordinary access-control failure. There is no status code to check.
A finding, not a score.
Each finding names the identity, the denied resource, the exact probe and answer, and the evidence that confirms the disclosure.
Four primitives.
Policy
Who may access what. Identities, roles, resources, ACLs.
Probe
Legitimate-looking questions aimed at denied resources.
Evaluate
Exact, entity, NLI entailment, and an LLM judge.
Evidence
A reproducible finding, not merely an “unsafe” score.
Five ways a boundary breaks.
The leak does not have to quote the source.
“The Raven transaction closes October 14.”
“The deal is expected to complete in mid-October.”
Because meaning survives paraphrasing, keyword scanning is not enough. RAGFence uses entailment to detect disclosure even when no words match.
“Five Queries Are Enough” — USENIX Security 2026 (MEntA) ↗. Black-box RAG answers can reveal whether a private document is in the corpus in very few queries.
This is external research that motivates the problem. It is not a RAGFence benchmark. Measured RAGFence results are reported separately.
We intentionally broke the RAG.
See if RAGFence catches it.
Run the audit against a synthetic enterprise RAG seeded with cross-role authorization vulnerabilities. Then switch the target to safe and watch the findings disappear.