warden
Fail-closed authorization gateway for agentic RAG — capability-label pushdown, deny-aware barriers, per-turn agent-context revalidation.
A fail-closed authorization gateway that ensures AI agents only retrieve and cite documents a specific user is actually permitted to see, with per-turn revalidation.
Warden is a security gateway designed to sit inside AI systems that retrieve documents to answer questions, a pattern often called RAG, short for retrieval-augmented generation. Its job is to make sure an AI agent only ever sees and cites documents that the specific person it is acting for is actually allowed to see, even as that agent pulls information from a shared, multi-tenant knowledge base.
The project explains that the two common approaches to this problem both have flaws. Checking permissions after fetching results is fast but breaks down if the person is only authorized to see a tiny fraction of documents, since a normal search would then return almost nothing they are allowed to read. The opposite approach, listing every document a person can access ahead of time, stays accurate but becomes far too slow once someone is authorized on millions of documents. Warden's answer is to compress permissions into small labels that can be checked cheaply during the initial search, and then treat that as just a performance shortcut, backed by a separate, authoritative permission check on the smaller set of results before anything reaches the AI model.
Beyond that initial check, Warden also re-verifies permissions before every single call to the AI model and again before a final answer is given, so that if someone's access to a document is revoked mid conversation, that document gets removed from what the AI can see and cite. Importantly, the identity of the person asking is tied to the session on the server side, never something the AI model itself can influence through its input, which is meant to close off a class of prompt injection attacks that try to trick the agent into revealing something it should not.
It is built in Python using FastAPI, with Postgres and its pgvector extension for storing both the permission data and the document vectors together, plus Redis for caching, and it can also work alongside OpenFGA, an existing permission system some teams already use. The project explicitly says it is not production hardened yet and describes itself as still shipping in stages, with a license still to be decided.
Where it fits
- Enforce per-user document permissions inside an AI agent's retrieval pipeline in a multi-tenant knowledge base.
- Re-check every document reference before each model call so revoked access is removed mid-conversation.
- Prevent prompt-injection attacks from leaking unauthorized documents by binding identity server-side, not to model input.