When documents are copied into a RAG or agent index, their access controls get left behind. People change teams, sharing gets revoked, an embedding model gets upgraded — and the index quietly keeps serving what it learned on day one. raggate finds every chunk an identity can retrieve but shouldn't, fixes it in place — non-destructively and reversibly — and re-runs the gate to prove zero leaks. Every verdict ships with replayable evidence.
Authorization engines answer "can X read Y?" — and keep answering correctly while retrieval quietly changes which Y come back. Three regressions we plant in our benchmark corpus, and catch on every run:
Bob loses project access on Monday. The project's chunks were embedded last month. His queries still surface them — the index never heard about the revocation.
Tenant A's pricing query is a near-perfect match for tenant B's pricing template. Pure vector similarity doesn't know what a tenant is.
A "better" embedding model reaches further semantically. Permissions untouched — and documents that were unreachable yesterday are in answers today.
Most tools hand you a finding and leave the cleanup to you. raggate closes the loop: it generates a remediation plan, applies it against your index with your approval — query-time pre-filter first, never a destructive delete by default — then re-runs the gate and asserts zero leaks. Every action is reversible with one command, and the before/after is written to the same replayable evidence stream.
A point-in-time YAML of who-can-read-what, pulled from your source of truth — Drive, SharePoint, Lark, GitLab, your IdP, or your authz service. Open spec, one file, raggate validate-snapshot checks it before anything runs.
Ingest your corpus (or adapt your retriever behind one interface: retrieve(query, identity, top_k)). Write scenarios: identities, queries, and what they must never see.
raggate run exits 0 or 1. Wire it into CI so every pipeline change re-proves the access boundary. Evidence and reports accumulate as your audit trail.
A pipeline is one retrieval index / knowledge base / agent app — its own corpus, retriever config, permission snapshots, and scenarios. Environments don't count extra. Runs are unlimited: a gate should never charge you for testing more.
One pipeline, non-production, community support. The full gate and evidence reports, for kicking the tires. Most teams start with the pilot instead — it answers the question your security review actually asks.
A pipeline = one retrieval index / knowledge base / agent app. Environments don't count extra; runs are unlimited — a gate should never charge you for testing more. Today every button reaches a human who responds fast.
Tell us what you're shipping and who blocks you at launch. We reply from a human, fast. Nothing here touches your corpus or ACLs.