{"id":2362,"date":"2026-09-25T08:00:27","date_gmt":"2026-09-25T08:00:27","guid":{"rendered":"https:\/\/www.dobryakov.com\/blog\/2362\/"},"modified":"2026-09-25T08:00:27","modified_gmt":"2026-09-25T08:00:27","slug":"ai-governance-access-control","status":"publish","type":"post","link":"https:\/\/www.dobryakov.com\/blog\/2362\/","title":{"rendered":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435"},"content":{"rendered":"<p>\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u0438\u0441\u0442 \u00ab\u041a\u043e\u0432\u0447\u0435\u0433\u0430\u00bb \u0441\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430: \u00ab\u041a\u0430\u043a\u0438\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043f\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0441\u0434\u0435\u043b\u043a\u0435 \u0441 \u044d\u0442\u0438\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c?\u00bb \u0410\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442 \u0447\u0435\u0441\u0442\u043d\u043e \u0438\u0449\u0435\u0442 \u0432 RAG-\u0438\u043d\u0434\u0435\u043a\u0441\u0435, \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u0438\u0437 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0442\u0434\u0435\u043b\u0430 \u0438 \u043e\u0442\u0434\u0430\u0451\u0442. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430: \u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u0438\u0441\u0442\u0430 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u044d\u0442\u043e\u043c\u0443 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0443 \u0432 SharePoint. \u041e\u043d \u043d\u0435 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u2014 \u043e\u043d \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u043f\u0440\u043e\u0441\u0438\u043b \u0431\u043e\u0442\u0430, \u0430 \u0431\u043e\u0442 \u043d\u0435 \u0441\u0443\u0431\u044a\u0435\u043a\u0442 \u043f\u0440\u0430\u0432. \u0420\u0435\u0442\u0440\u0438\u0432\u0435\u0440 \u043d\u0430\u0448\u0451\u043b \u0441\u0430\u043c\u043e\u0435 \u0440\u0435\u043b\u0435\u0432\u0430\u043d\u0442\u043d\u043e\u0435, \u043c\u043e\u0434\u0435\u043b\u044c \u043f\u0435\u0440\u0435\u0441\u043a\u0430\u0437\u0430\u043b\u0430. \u0422\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u0418\u0418 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0443\u0442\u0435\u0447\u043a\u0430: \u0434\u0430\u043d\u043d\u044b\u0435, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0435, \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430.<\/p>\n<p><!--more--><\/p>\n<p>\u042d\u0442\u043e \u0444\u0443\u043d\u0434\u0430\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u0435\u0444\u0435\u043a\u0442 \u043d\u0430\u0438\u0432\u043d\u043e\u0433\u043e RAG. \u0418\u043d\u0434\u0435\u043a\u0441\u0430\u0446\u0438\u044f \u0441\u0445\u043b\u043e\u043f\u044b\u0432\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u043e\u0434\u0438\u043d \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u044b\u0439 \u0438\u043d\u0434\u0435\u043a\u0441, \u0430 \u043f\u043e\u0438\u0441\u043a \u043f\u043e \u0441\u043c\u044b\u0441\u043b\u0443 \u043d\u0435 \u0437\u043d\u0430\u0435\u0442 \u043f\u0440\u043e \u043f\u0440\u0430\u0432\u0430. \u041d\u0438\u0436\u0435 \u2014 \u043a\u0430\u043a \u044d\u0442\u043e \u0447\u0438\u043d\u0438\u0442\u0441\u044f: \u043e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430 \u0434\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430, \u0448\u0430\u0433\u043e\u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0440\u0435\u0436\u0438\u043c\u043e\u0432 \u043e\u0442\u043a\u0430\u0437\u0430.<\/p>\n<h2>\u0411\u0438\u0437\u043d\u0435\u0441-\u0446\u0435\u043b\u044c<\/h2>\n<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u00ab\u041a\u043e\u0432\u0447\u0435\u0433\u0430\u00bb \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0438\u0437 RAG \u0440\u043e\u0432\u043d\u043e \u0442\u043e, \u0447\u0442\u043e \u0435\u043c\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u0432\u0438\u0434\u0435\u0442\u044c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u2014 \u043d\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041e\u0431\u0435\u0449\u0430\u043d\u0438\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0443:<\/p>\n<ol>\n<li>\u041d\u0438 \u043e\u0434\u0438\u043d \u043e\u0442\u0432\u0435\u0442 \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0430\u043d\u043d\u044b\u0445, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u0441\u043f\u0440\u043e\u0441\u0438\u0432\u0448\u0435\u0433\u043e \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0435.<\/li>\n<li>\u041e\u0442\u0437\u044b\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0435 \u043e\u0442\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432 RAG \u0437\u0430 \u043c\u0438\u043d\u0443\u0442\u044b, \u043d\u0435 \u0437\u0430 \u0441\u0443\u0442\u043a\u0438.<\/li>\n<li>\u041d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u0440\u0435\u0433\u0443\u043b\u044f\u0442\u043e\u0440\u0430 \u0438\u043b\u0438 \u0430\u0443\u0434\u0438\u0442\u0430 \u00ab\u043f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e\u0442 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a \u044d\u0442\u043e \u0443\u0432\u0438\u0434\u0435\u043b\u00bb \u043e\u0442\u0432\u0435\u0442 \u043b\u0435\u0436\u0438\u0442 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445, \u0430 \u043d\u0435 \u0432 \u0443\u0434\u0430\u0447\u0435 \u0440\u0435\u0442\u0440\u0438\u0432\u0435\u0440\u0430.<\/li>\n<\/ol>\n<h2>\u0427\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0435<\/h2>\n<ul>\n<li><strong>Confused deputy.<\/strong> \u0418\u0418 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0442 \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438\u043d\u0434\u0435\u043a\u0441\u0430, \u0430 \u043d\u0435 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0443\u0442\u0435\u0447\u043a\u0438.<\/li>\n<li><strong>OWASP LLM.<\/strong> LLM02 (Sensitive Info Disclosure), LLM06 (Excessive Agency \u2014 \u043a\u043e\u0433\u0434\u0430 RAG-tools \u0445\u043e\u0434\u044f\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u044b).<\/li>\n<li><strong>GDPR \/ \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0430\u044f \u0442\u0430\u0439\u043d\u0430.<\/strong> \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0431\u0435\u0437 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u044f \u2014 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.<\/li>\n<li><strong>\u0410\u0443\u0434\u0438\u0442 AI Act.<\/strong> \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c high-risk \u0434\u043e\u043b\u0436\u0435\u043d \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u043e\u0431\u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u0442\u044c\u0441\u044f.<\/li>\n<\/ul>\n<h2>\u0410\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0439 \u043f\u0430\u0442\u0442\u0435\u0440\u043d: Identity-Aware Hybrid Filtering RAG<\/h2>\n<p>\u041a\u043e\u043d\u0435\u043d\u0441\u0443\u0441 enterprise-\u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b 2026 \u0433\u043e\u0434\u0430: \u043d\u0435 \u0432\u044b\u0431\u0438\u0440\u0430\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u0431\u044b\u0441\u0442\u0440\u044b\u043c pre-filter \u0438 \u0442\u043e\u0447\u043d\u044b\u043c authz, \u0430 \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u0442\u044c \u043e\u0431\u0430.<\/p>\n<pre><code>JWT(user: groups, roles, tenant_id)\n        \u2502\n        \u25bc\n[1] Pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414 \u043f\u043e ACL-\u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u043c (recall, \u0434\u0451\u0448\u0435\u0432\u043e)\n        \u2502  \u043a\u0430\u043d\u0434\u0438\u0434\u0430\u0442\u044b-\u0447\u0430\u043d\u043a\u0438\n        \u25bc\n[2] FGA post-check: CheckBulkPermissions \u043f\u043e source-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0447\u0430\u043d\u043a\u0430\n        \u2502  \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u044b\u0435 \u0447\u0430\u043d\u043a\u0438          (\u0442\u043e\u0447\u043d\u043e\u0441\u0442\u044c, ReBAC\/ABAC)\n        \u25bc\n[3] LLM  \u2192  [4] OPA post-filter \u043e\u0442\u0432\u0435\u0442\u0430 (\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0439, \u0437\u0430\u043f\u0440\u0435\u0442 \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0439)<\/code><\/pre>\n<p>Pre-filter \u043e\u0442\u0441\u0435\u043a\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043c\u0430\u0441\u0441\u0443 \u0434\u0451\u0448\u0435\u0432\u043e. FGA-\u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u0430\u0451\u0442 \u0442\u043e\u0447\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0442\u0430\u043c, \u0433\u0434\u0435 payload-\u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u043c\u0430\u043b\u043e: \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u044f, ABAC-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442. \u041f\u0440\u0430\u0432\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u0430\u0435\u0442 \u0432 \u0441\u0430\u043c \u0440\u0435\u0442\u0440\u0438\u0432, \u0430 \u043d\u0435 \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u044b\u0434\u0430\u0447\u0443 \u043f\u043e\u0441\u0442\u0444\u0430\u043a\u0442\u0443\u043c.<\/p>\n<h2>\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u044b\u0439 \u0441\u0442\u0435\u043a<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u0421\u043b\u043e\u0439<\/th>\n<th>\u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Vector DB \u0441 payload-\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u043c\u0438<\/td>\n<td>Qdrant, Pinecone, PostgreSQL (pgvector)<\/td>\n<\/tr>\n<tr>\n<td>Identity<\/td>\n<td>OpenID Connect (OIDC), Keycloak; JWT \u0441 <code>groups<\/code>, <code>roles<\/code>, <code>tenant_id<\/code><\/td>\n<\/tr>\n<tr>\n<td>Fine-Grained Authorization (ReBAC\/ABAC)<\/td>\n<td>OpenFGA, SpiceDB, Cerbos, Auth0 FGA \u2014 <code>CheckBulkPermissions<\/code> \u0432 \u043f\u0443\u0442\u0438 \u0440\u0435\u0442\u0440\u0438\u0432\u0430<\/td>\n<\/tr>\n<tr>\n<td>Policy \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435<\/td>\n<td>OPA (Rego)<\/td>\n<\/tr>\n<tr>\n<td>\u041e\u0440\u043a\u0435\u0441\u0442\u0440\u0430\u0446\u0438\u044f<\/td>\n<td>LlamaIndex \/ LangChain<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f<\/h2>\n<h3>\u0428\u0430\u0433 1. ACL \u043a\u0430\u043a \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0430\u043d\u043a\u0430 + \u0432\u0435\u0440\u0441\u0438\u044f<\/h3>\n<p>\u041f\u0440\u0438 \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u0446\u0438\u0438 \u0432 payload \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0447\u0430\u043d\u043a\u0430 \u043a\u043b\u0430\u0434\u0451\u043c \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u0441\u0441\u0438\u0432 ACL \u0438 <code>acl_version<\/code>. \u0412\u0435\u0440\u0441\u0438\u044f \u2014 \u043a\u043b\u044e\u0447 \u043a \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438.<\/p>\n<pre><code class=\"language-python\">payload = {\n    &quot;tenant_id&quot;: doc.tenant_id,\n    &quot;allowed_groups&quot;: doc.acl_groups,     # \u0438\u0437 \u043f\u0435\u0440\u0432\u043e\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\n    &quot;source_doc_id&quot;: doc.id,              # \u0434\u043b\u044f FGA post-check\n    &quot;acl_version&quot;: doc.acl_version,\n}<\/code><\/pre>\n<h3>\u0428\u0430\u0433 2. Pre-filter \u043f\u043e \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 JWT<\/h3>\n<pre><code class=\"language-python\">flt = {&quot;must&quot;: [\n    {&quot;key&quot;: &quot;tenant_id&quot;,     &quot;match&quot;: {&quot;value&quot;: user.tenant_id}},\n    {&quot;key&quot;: &quot;allowed_groups&quot;,&quot;match&quot;: {&quot;any&quot;: user.groups}},\n]}\ncandidates = qdrant.search(query_vec, query_filter=flt, limit=50)<\/code><\/pre>\n<h3>\u0428\u0430\u0433 3. FGA post-check \u043f\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0443<\/h3>\n<pre><code class=\"language-python\">allowed = fga.batch_check(\n    user=f&quot;user:{user.id}&quot;,\n    relation=&quot;viewer&quot;,\n    objects=[f&quot;doc:{c.payload[&#x27;source_doc_id&#x27;]}&quot; for c in candidates],\n)\nchunks = [c for c in candidates if allowed[c.payload[&quot;source_doc_id&quot;]]]<\/code><\/pre>\n<h3>\u0428\u0430\u0433 4. \u0421\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL \u2014 \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f, \u043d\u0435 \u0431\u0430\u0442\u0447\u0435\u0432\u0430\u044f<\/h3>\n<p>\u041f\u043e\u0434\u043f\u0438\u0441\u043a\u0430 \u043d\u0430 permission-change webhooks \u0438\u0437 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432; \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432 \u0440\u0435\u043a\u043e\u043d\u0441\u0438\u043b\u0438\u0442\u0441\u044f \u0432 \u043c\u0438\u043d\u0443\u0442\u044b. \u0411\u0430\u043c\u043f\u0430\u0435\u043c <code>acl_version<\/code> \u2192 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0435 \u0447\u0430\u043d\u043a\u0438 \u0438\u043d\u0432\u0430\u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0442\u0441\u044f. \u0411\u0430\u0442\u0447\u0435\u0432\u0430\u044f \u043d\u043e\u0447\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u0437\u0434\u0435\u0441\u044c \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u0430: \u0441\u0443\u0442\u043a\u0438 \u0441 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u2014 \u044d\u0442\u043e \u0441\u0443\u0442\u043a\u0438 \u0443\u0442\u0435\u0447\u043a\u0438.<\/p>\n<h3>\u0428\u0430\u0433 5. OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435<\/h3>\n<p>\u0424\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u0432\u0435\u0442 \u0438 \u0446\u0438\u0442\u0430\u0442\u044b \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443: \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0439, \u0437\u0430\u043f\u0440\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0439, \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445-\u0441\u0441\u044b\u043b\u043e\u043a.<\/p>\n<h2>\u0413\u0434\u0435 \u043b\u043e\u043c\u0430\u0435\u0442\u0441\u044f<\/h2>\n<ul>\n<li><strong>\u0420\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d ACL \u2014 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0440\u0438\u0441\u043a.<\/strong> \u041f\u0440\u0430\u0432\u0430 \u0432 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0435 \u0441\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c, \u0438\u043d\u0434\u0435\u043a\u0441 \u043e\u0442\u0441\u0442\u0430\u043b \u2192 \u043e\u0442\u0434\u0430\u0451\u043c \u0443\u0436\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0451\u043d\u043d\u043e\u0435. \u041b\u0435\u0447\u0438\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u043e\u0439 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0438 FGA-\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438. Pre-filter \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0443 \u0432\u0441\u0435\u0433\u0434\u0430 \u043e\u0442\u0441\u0442\u0430\u0451\u0442 \u043d\u0430 \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0443 \u043b\u0430\u0433\u0430.<\/li>\n<li><strong>\u0423\u0442\u0435\u0447\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0433\u0440\u0435\u0433\u0430\u0446\u0438\u044e.<\/strong> \u0420\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u044b\u0435 \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0430\u043d\u043a\u0438 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u043f\u0440\u0435\u0449\u0451\u043d\u043d\u043e\u0435. \u041d\u0438 pre-filter, \u043d\u0438 FGA \u044d\u0442\u043e\u0433\u043e \u043d\u0435 \u0432\u0438\u0434\u044f\u0442 \u2014 \u043d\u0443\u0436\u043d\u0430 \u043b\u043e\u0433\u0438\u043a\u0430 \u0443\u0440\u043e\u0432\u043d\u044f OPA \u0438 \u0431\u0438\u0437\u043d\u0435\u0441-\u043f\u0440\u0430\u0432\u0438\u043b.<\/li>\n<li><strong>\u041c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435-\u0446\u0438\u0442\u0430\u0442\u044b.<\/strong> \u041a\u043e\u043d\u0442\u0435\u043d\u0442 \u043e\u0442\u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432\u0430\u043d, \u043d\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a \u0438\u043b\u0438 \u0441\u0441\u044b\u043b\u043a\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 \u0432 \u043e\u0442\u0432\u0435\u0442\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u0430\u043c \u0444\u0430\u043a\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430. \u0427\u0438\u0441\u0442\u0438\u0442\u044c \u0446\u0438\u0442\u0430\u0442\u044b \u0442\u043e\u0436\u0435.<\/li>\n<li><strong>\u041b\u0430\u0442\u0435\u043d\u0442\u043d\u043e\u0441\u0442\u044c FGA.<\/strong> <code>CheckBulkPermissions<\/code> \u043d\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u0438 \u0447\u0430\u043d\u043a\u043e\u0432 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0443. \u0411\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u0443\u0439\u0442\u0435 \u0433\u043b\u0443\u0431\u0438\u043d\u0443 pre-filter \u0438 \u043e\u0431\u044a\u0451\u043c post-check.<\/li>\n<li><strong>ABAC-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442.<\/strong> \u00ab\u0414\u043e\u0441\u0442\u0443\u043f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \/ \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e \u0441\u0432\u043e\u0435\u043c\u0443 \u0440\u0435\u0433\u0438\u043e\u043d\u0443 \/ \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u0431\u0438\u0437\u043d\u0435\u0441-\u043e\u0431\u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00bb \u043f\u043b\u043e\u0445\u043e \u043b\u043e\u0436\u0438\u0442\u0441\u044f \u0432 payload \u2014 \u0443\u0445\u043e\u0434\u0438\u0442 \u0432 FGA\/OPA, \u0440\u0430\u0441\u0442\u0451\u0442 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c.<\/li>\n<\/ul>\n<h2>\u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u044b \u0438 \u043c\u0430\u043f\u043f\u0438\u043d\u0433<\/h2>\n<ul>\n<li><strong>ISO\/IEC 42001<\/strong>: \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0418\u0418.<\/li>\n<li><strong>EU AI Act<\/strong>: Art. 10 (data governance), \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f high-risk.<\/li>\n<li><strong>OWASP LLM<\/strong>: LLM02, LLM06.<\/li>\n<li><strong>NIST AI RMF<\/strong>: Govern\/Map \u2014 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430.<\/li>\n<\/ul>\n<h2>\u041b\u0430\u0431\u0430 \u0438 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442<\/h2>\n<p>\u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c Qdrant \u0441 payload-ACL \u0438 <code>acl_version<\/code> \u0434\u043b\u044f \u00ab\u041a\u043e\u0432\u0447\u0435\u0433\u0430\u00bb, OIDC \u0447\u0435\u0440\u0435\u0437 Keycloak, pre-filter \u043f\u043e <code>tenant_id<\/code> + <code>groups<\/code>, OpenFGA-\u043c\u043e\u0434\u0435\u043b\u044c \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0439 + <code>batch_check<\/code> \u0432 \u043f\u0443\u0442\u0438 \u0440\u0435\u0442\u0440\u0438\u0432\u0430, webhook-\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u043e\u0442\u0437\u044b\u0432\u0430 \u043f\u0440\u0430\u0432, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435. \u0422\u0435\u0441\u0442: \u0434\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0437\u0430\u0434\u0430\u044e\u0442 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u0438\u0437 \u0432\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u2014 \u0441\u0440\u0430\u0432\u043d\u0438\u0442\u044c \u0432\u044b\u0434\u0430\u0447\u0443; \u043e\u0442\u043e\u0437\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u0437\u0430\u043c\u0435\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043a\u043e\u043d\u0441\u0438\u043b\u044f\u0446\u0438\u0438.<\/p>\n<p><strong>\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442<\/strong>: FGA-\u043c\u043e\u0434\u0435\u043b\u044c + rego-\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 + \u0442\u0435\u0441\u0442-\u043c\u0430\u0442\u0440\u0438\u0446\u0430 \u00ab\u0440\u043e\u043b\u044c \u00d7 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u2192 \u0434\u043e\u0441\u0442\u0443\u043f\u00bb + \u043c\u0435\u0442\u0440\u0438\u043a\u0430 \u043b\u0430\u0433\u0430 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438.<\/p>\n<h2>\u0427\u0435\u043a\u043b\u0438\u0441\u0442 \u0437\u0440\u0435\u043b\u043e\u0441\u0442\u0438<\/h2>\n<ul>\n<li><strong>L1<\/strong>: \u0435\u0434\u0438\u043d\u044b\u0439 \u0438\u043d\u0434\u0435\u043a\u0441 \u0441 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u043c \u043f\u043e <code>tenant_id<\/code>.<\/li>\n<li><strong>L2<\/strong>: pre-filter \u043f\u043e \u0433\u0440\u0443\u043f\u043f\u0430\u043c \u0438\u0437 JWT + FGA post-check \u043f\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0443, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.<\/li>\n<li><strong>L3<\/strong>: \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL (\u043c\u0438\u043d\u0443\u0442\u044b), \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0433\u0440\u0435\u0433\u0430\u0446\u0438\u0438 \u0438 \u0443\u0442\u0435\u0447\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0446\u0438\u0442\u0430\u0442\u044b, ABAC-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442, \u0430\u0443\u0434\u0438\u0442 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.<\/li>\n<\/ul>\n<h2>\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438<\/h2>\n<ul>\n<li><a href=\"https:\/\/truto.one\/blog\/how-to-maintain-document-level-rbac-in-enterprise-rag-pipelines\/\">Document-Level RBAC for RAG (2026 guide, Truto)<\/a><\/li>\n<li><a href=\"https:\/\/auth0.com\/ai\/docs\/intro\/authorization-for-rag\">Fine-Grained Authorization for RAG with OpenFGA (Auth0)<\/a><\/li>\n<li><a href=\"https:\/\/www.osohq.com\/post\/right-approach-to-authorization-in-rag\">The Right Approach to Authorization in RAG (Oso)<\/a><\/li>\n<li><a href=\"https:\/\/www.pinecone.io\/learn\/rag-access-control\/\">RAG with Access Control (Pinecone)<\/a><\/li>\n<\/ul>\n<p>\u0415\u0441\u043b\u0438 \u0432\u0430\u0448 RAG \u043e\u0442\u0434\u0430\u0451\u0442 \u043e\u0442\u0432\u0435\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0435 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u2014 \u0443 \u0432\u0430\u0441 \u043d\u0435 \u0443\u043c\u043d\u044b\u0439 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442, \u0430 \u0434\u044b\u0440\u0430 \u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0435, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u0447\u0430\u0442.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0418\u043d\u0434\u0435\u043a\u0441\u0430\u0446\u0438\u044f \u0441\u0445\u043b\u043e\u043f\u044b\u0432\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u043e\u0434\u0438\u043d \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u044b\u0439 \u0438\u043d\u0434\u0435\u043a\u0441. \u0420\u0435\u0442\u0440\u0438\u0432\u0435\u0440 \u043d\u0430\u0445\u043e\u0434\u0438\u0442 \u0441\u0430\u043c\u043e\u0435 \u0440\u0435\u043b\u0435\u0432\u0430\u043d\u0442\u043d\u043e\u0435, \u043c\u043e\u0434\u0435\u043b\u044c \u043f\u0435\u0440\u0435\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u2014 \u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u0438\u0441\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u044e\u0440\u043e\u0442\u0434\u0435\u043b\u0430, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443 \u043d\u0435\u0433\u043e \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 SharePoint.<\/p>\n","protected":false},"author":0,"featured_media":2361,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.dobryakov.com\/blog\/2362\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"\u0413\u0440\u0438\u0433\u043e\u0440\u0438\u0439 \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432 - \u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT+AI | \u0411\u043b\u043e\u0433 \u0413\u0440\u0438\u0433\u043e\u0440\u0438\u044f \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432\u0430: \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.dobryakov.com\/blog\/2362\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-25T08:00:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-25T08:00:27+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f\" \/>\n\t\t<meta name=\"twitter:description\" content=\"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#blogposting\",\"name\":\"\\u0411\\u0435\\u0437\\u043e\\u043f\\u0430\\u0441\\u043d\\u044b\\u0439 RAG \\u0441 RBAC\\\/ABAC: identity-aware \\u0444\\u0438\\u043b\\u044c\\u0442\\u0440\\u0430\\u0446\\u0438\\u044f\",\"headline\":\"Enterprise Access Control: \\u043a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c RAG, \\u043a\\u043e\\u0442\\u043e\\u0440\\u044b\\u0439 \\u043d\\u0435 \\u0441\\u043b\\u0438\\u0432\\u0430\\u0435\\u0442 \\u0447\\u0443\\u0436\\u0438\\u0435 \\u0434\\u0430\\u043d\\u043d\\u044b\\u0435\",\"author\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/author\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/ai-governance-access-control.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Enterprise Access Control: \\u043a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c RAG, \\u043a\\u043e\\u0442\\u043e\\u0440\\u044b\\u0439 \\u043d\\u0435 \\u0441\\u043b\\u0438\\u0432\\u0430\\u0435\\u0442 \\u0447\\u0443\\u0436\\u0438\\u0435 \\u0434\\u0430\\u043d\\u043d\\u044b\\u0435\"},\"datePublished\":\"2026-09-25T08:00:27+00:00\",\"dateModified\":\"2026-09-25T08:00:27+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#webpage\"},\"articleSection\":\"Uncategorized\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/category\\\/uncategorized\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#listItem\",\"name\":\"Enterprise Access Control: \\u043a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c RAG, \\u043a\\u043e\\u0442\\u043e\\u0440\\u044b\\u0439 \\u043d\\u0435 \\u0441\\u043b\\u0438\\u0432\\u0430\\u0435\\u0442 \\u0447\\u0443\\u0436\\u0438\\u0435 \\u0434\\u0430\\u043d\\u043d\\u044b\\u0435\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#listItem\",\"position\":3,\"name\":\"Enterprise Access Control: \\u043a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c RAG, \\u043a\\u043e\\u0442\\u043e\\u0440\\u044b\\u0439 \\u043d\\u0435 \\u0441\\u043b\\u0438\\u0432\\u0430\\u0435\\u0442 \\u0447\\u0443\\u0436\\u0438\\u0435 \\u0434\\u0430\\u043d\\u043d\\u044b\\u0435\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/#organization\",\"name\":\"\\u0413\\u0440\\u0438\\u0433\\u043e\\u0440\\u0438\\u0439 \\u0414\\u043e\\u0431\\u0440\\u044f\\u043a\\u043e\\u0432 - \\u0411\\u043b\\u043e\\u0433 \\u043f\\u0440\\u043e IT+AI\",\"description\":\"\\u0411\\u043b\\u043e\\u0433 \\u0413\\u0440\\u0438\\u0433\\u043e\\u0440\\u0438\\u044f \\u0414\\u043e\\u0431\\u0440\\u044f\\u043a\\u043e\\u0432\\u0430: \\u0443\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u043e\\u0435\\u043a\\u0442\\u0430\\u043c\\u0438, \\u043c\\u0435\\u043d\\u0435\\u0434\\u0436\\u043c\\u0435\\u043d\\u0442, \\u0440\\u0430\\u0437\\u0440\\u0430\\u0431\\u043e\\u0442\\u043a\\u0430 \\u0438 \\u0442\\u0435\\u0441\\u0442\\u0438\\u0440\\u043e\\u0432\\u0430\\u043d\\u0438\\u0435\",\"url\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#webpage\",\"url\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/\",\"name\":\"\\u0411\\u0435\\u0437\\u043e\\u043f\\u0430\\u0441\\u043d\\u044b\\u0439 RAG \\u0441 RBAC\\\/ABAC: identity-aware \\u0444\\u0438\\u043b\\u044c\\u0442\\u0440\\u0430\\u0446\\u0438\\u044f\",\"description\":\"\\u041a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c enterprise RAG \\u0441 identity-aware \\u0444\\u0438\\u043b\\u044c\\u0442\\u0440\\u0430\\u0446\\u0438\\u0435\\u0439: pre-filter \\u0432 \\u0432\\u0435\\u043a\\u0442\\u043e\\u0440\\u043d\\u043e\\u0439 \\u0411\\u0414, FGA post-check, \\u0441\\u043e\\u0431\\u044b\\u0442\\u0438\\u0439\\u043d\\u0430\\u044f \\u0441\\u0438\\u043d\\u0445\\u0440\\u043e\\u043d\\u0438\\u0437\\u0430\\u0446\\u0438\\u044f ACL, OPA \\u043d\\u0430 \\u0432\\u044b\\u0445\\u043e\\u0434\\u0435.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/author\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/author\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/ai-governance-access-control.jpg\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Enterprise Access Control: \\u043a\\u0430\\u043a \\u043f\\u043e\\u0441\\u0442\\u0440\\u043e\\u0438\\u0442\\u044c RAG, \\u043a\\u043e\\u0442\\u043e\\u0440\\u044b\\u0439 \\u043d\\u0435 \\u0441\\u043b\\u0438\\u0432\\u0430\\u0435\\u0442 \\u0447\\u0443\\u0436\\u0438\\u0435 \\u0434\\u0430\\u043d\\u043d\\u044b\\u0435\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/2362\\\/#mainImage\"},\"datePublished\":\"2026-09-25T08:00:27+00:00\",\"dateModified\":\"2026-09-25T08:00:27+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/\",\"name\":\"\\u0413\\u0440\\u0438\\u0433\\u043e\\u0440\\u0438\\u0439 \\u0414\\u043e\\u0431\\u0440\\u044f\\u043a\\u043e\\u0432 - \\u0411\\u043b\\u043e\\u0433 \\u043f\\u0440\\u043e IT+AI\",\"description\":\"\\u0411\\u043b\\u043e\\u0433 \\u0413\\u0440\\u0438\\u0433\\u043e\\u0440\\u0438\\u044f \\u0414\\u043e\\u0431\\u0440\\u044f\\u043a\\u043e\\u0432\\u0430: \\u0443\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u043e\\u0435\\u043a\\u0442\\u0430\\u043c\\u0438, \\u043c\\u0435\\u043d\\u0435\\u0434\\u0436\\u043c\\u0435\\u043d\\u0442, \\u0440\\u0430\\u0437\\u0440\\u0430\\u0431\\u043e\\u0442\\u043a\\u0430 \\u0438 \\u0442\\u0435\\u0441\\u0442\\u0438\\u0440\\u043e\\u0432\\u0430\\u043d\\u0438\\u0435\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dobryakov.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","canonical_url":"https:\/\/www.dobryakov.com\/blog\/2362\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#blogposting","name":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","headline":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435","author":{"@id":"https:\/\/www.dobryakov.com\/blog\/author\/#author"},"publisher":{"@id":"https:\/\/www.dobryakov.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.dobryakov.com\/blog\/wp-content\/uploads\/2026\/09\/ai-governance-access-control.jpg","width":1200,"height":630,"caption":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435"},"datePublished":"2026-09-25T08:00:27+00:00","dateModified":"2026-09-25T08:00:27+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#webpage"},"isPartOf":{"@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#webpage"},"articleSection":"Uncategorized"},{"@type":"BreadcrumbList","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.dobryakov.com\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}},{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/#listItem","position":2,"name":"Uncategorized","item":"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#listItem","name":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#listItem","position":3,"name":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435","previousItem":{"@type":"ListItem","@id":"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}}]},{"@type":"Organization","@id":"https:\/\/www.dobryakov.com\/blog\/#organization","name":"\u0413\u0440\u0438\u0433\u043e\u0440\u0438\u0439 \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432 - \u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT+AI","description":"\u0411\u043b\u043e\u0433 \u0413\u0440\u0438\u0433\u043e\u0440\u0438\u044f \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432\u0430: \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435","url":"https:\/\/www.dobryakov.com\/blog\/"},{"@type":"WebPage","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#webpage","url":"https:\/\/www.dobryakov.com\/blog\/2362\/","name":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.dobryakov.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#breadcrumblist"},"author":{"@id":"https:\/\/www.dobryakov.com\/blog\/author\/#author"},"creator":{"@id":"https:\/\/www.dobryakov.com\/blog\/author\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.dobryakov.com\/blog\/wp-content\/uploads\/2026\/09\/ai-governance-access-control.jpg","@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#mainImage","width":1200,"height":630,"caption":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435"},"primaryImageOfPage":{"@id":"https:\/\/www.dobryakov.com\/blog\/2362\/#mainImage"},"datePublished":"2026-09-25T08:00:27+00:00","dateModified":"2026-09-25T08:00:27+00:00"},{"@type":"WebSite","@id":"https:\/\/www.dobryakov.com\/blog\/#website","url":"https:\/\/www.dobryakov.com\/blog\/","name":"\u0413\u0440\u0438\u0433\u043e\u0440\u0438\u0439 \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432 - \u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT+AI","description":"\u0411\u043b\u043e\u0433 \u0413\u0440\u0438\u0433\u043e\u0440\u0438\u044f \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432\u0430: \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.dobryakov.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"\u0413\u0440\u0438\u0433\u043e\u0440\u0438\u0439 \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432 - \u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT+AI | \u0411\u043b\u043e\u0433 \u0413\u0440\u0438\u0433\u043e\u0440\u0438\u044f \u0414\u043e\u0431\u0440\u044f\u043a\u043e\u0432\u0430: \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435","og:type":"article","og:title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","og:description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","og:url":"https:\/\/www.dobryakov.com\/blog\/2362\/","article:published_time":"2026-09-25T08:00:27+00:00","article:modified_time":"2026-09-25T08:00:27+00:00","twitter:card":"summary_large_image","twitter:title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","twitter:description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435."},"aioseo_meta_data":{"post_id":"2362","title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","og_description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":"\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 RAG \u0441 RBAC\/ABAC: identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f","twitter_description":"\u041a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c enterprise RAG \u0441 identity-aware \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439: pre-filter \u0432 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0411\u0414, FGA post-check, \u0441\u043e\u0431\u044b\u0442\u0438\u0439\u043d\u0430\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f ACL, OPA \u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435.","schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null,"created":"2026-09-25 08:00:32","updated":"2026-09-25 08:00:32"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.dobryakov.com\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/\" title=\"Uncategorized\">Uncategorized<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tEnterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.dobryakov.com\/blog"},{"label":"Uncategorized","link":"https:\/\/www.dobryakov.com\/blog\/category\/uncategorized\/"},{"label":"Enterprise Access Control: \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c RAG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043b\u0438\u0432\u0430\u0435\u0442 \u0447\u0443\u0436\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435","link":"https:\/\/www.dobryakov.com\/blog\/2362\/"}],"_links":{"self":[{"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/posts\/2362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/comments?post=2362"}],"version-history":[{"count":0,"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/posts\/2362\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/media\/2361"}],"wp:attachment":[{"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/media?parent=2362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/categories?post=2362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dobryakov.com\/blog\/wp-json\/wp\/v2\/tags?post=2362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}