A retrieval-augmented generation (RAG) assistant answers an engineer's question using salary documents from HR. All departments' documents were embedded into a single shared vector store, and retrieval returns the nearest matches without checking who is asking. Which weakness does this describe, and what fixes it?

In retrieval-augmented generation, documents are converted into embeddings and stored in a vector database; at query time the system retrieves the most similar chunks and passes them to the model as context. Similarity search has no notion of authorization, so when every department shares one index without access metadata, any user can retrieve any document semantically close to their question. The OWASP Top 10 for LLM Applications names this class vector and embedding weaknesses, and the remedy is permission-aware retrieval: attach access-control metadata to each chunk and filter on the requesting user's entitlements, or partition data into separate indexes per tenant or sensitivity level. Hallucination is invented output, whereas these salaries came from real retrieved documents; temperature does not affect what is retrieved. Prompt injection involves instructions that subvert the model, but the engineer asked an ordinary question and the system behaved as designed. Training data poisoning alters model weights through manipulated training data, and the base model never learned these salaries; they arrived at query time. Exam caveat: the model inherits whatever the retriever hands it, so access control belongs before the model. Operational check: query the assistant as users with different roles and confirm restricted chunks never appear in retrieved context.