RAG Access Control for Underwriting Guidelines: A Layered Architecture for Insurers

Why retrieval permissions alone are not enough

Underwriting guidelines hold appetite rules, referral thresholds, pricing inputs and eligibility criteria. Access to them is rarely uniform. A underwriter in one line of business may not be entitled to another line's referral thresholds, and a broker-facing application should see far less than an internal underwriting assistant.

A vector store permission check answers one question: which records may this caller query. It does not govern what ends up in model context or what the model says. OWASP guidance treats retrieval, prompt assembly and output as separate exposure points and names cross-user and cross-tenant leakage during retrieval and prompt assembly as a specific risk. It also lists relying on the language model to enforce access control as an anti-pattern. Enforcement has to happen before content reaches the model.

Three failure modes follow. Over-retrieval occurs when a broad similarity search returns chunks the requester should not see, which then sit in context. Cross-tenant or cross-line-of-business leakage occurs when chunks from one boundary are assembled into another requester's prompt, or when shared inference caches and model state carry content across users. Exposure through generated output occurs when the model paraphrases or summarizes a restricted threshold for someone who was never entitled to it. OWASP also notes that output keyword filtering is not sufficient on its own, and that embeddings should be treated as sensitive data with the same controls as the source documents.

Choosing an access model: RBAC, ABAC and the trade-off

NIST describes role-based access control as the predominant model, and attribute-based access control as one where access is granted or denied from attributes of the subject and the object, environment conditions, and policies written in terms of those attributes. NIST also characterizes ABAC as easy to set up but complex to manage. That trade-off should be decided explicitly rather than inherited.

For underwriting guidelines, roles are a reasonable coarse layer: underwriter, senior underwriter, actuarial, broker-facing application. They break down when entitlement depends on more than role, for example line of business, tenant, product, jurisdiction, or whether the caller is a person or an autonomous agent. Those cases fit attribute-based rules, which can combine subject attributes, chunk attributes and conditions such as the calling application.

A workable pattern is to use roles for baseline entitlements and attributes for the boundaries where leakage is costly. Keep the attribute set small. Every attribute added to chunk metadata is another value that must be tagged correctly at ingestion and kept in sync when source permissions change. Identity must also extend beyond human users, because applications, agents and tools retrieve guideline content too, and each needs its own scoped identity rather than a shared service account.

The evidence model: what each control should produce

Regulators and auditors want to see what a system was allowed to access and what it did. NYDFS Insurance Circular Letter No. 7, issued in final form on July 11, 2024, describes a process for identifying and assessing operational, financial and compliance risks of AI systems, with internal controls to mitigate them, and it maintains the expectation of oversight over third-party vendors. In a RAG system that oversight reaches model providers, vector database vendors and any enforcement tooling. Colorado SB 24-205, as of October 2026, includes a requirement to disclose algorithmic discrimination caused by a high-risk system to the attorney general within 90 days after discovery. Reviews under the NAIC AI Model Bulletin, NYDFS and Colorado frameworks will draw on the same underlying records.

Control definitions and decision records can serve as that evidence. Each control should leave a durable record:

At ingestion, the chunk metadata, the document digest from the manifest, and the pipeline identity that wrote to the index. At retrieval, the requester identity and the access metadata of every chunk returned. At context assembly, which chunks entered the prompt and any that were removed. At tool calls, the scope requested, the policy applied and any approval with its approver. At response, the policy applied and whether the output was allowed, redacted or blocked.

Retrieval records that carry identity and chunk-level access metadata are the most directly supported evidence type. Mapping any record to a specific regulatory request is a judgment each insurer makes for its own obligations.