Show HN: Secure AI contexts with open source reBAC-protected RAG and SQLite-vec (github.com)

A new open-source reference implementation—ReRAG—shows how to make Retrieval-Augmented Generation permission-aware by combining relationship-based access control (ReBAC) via Ory Keto (Google Zanzibar model) with local embedding and inference using Ollama and sqlite-vec. Instead of relying on the LLM to “respect” permissions, ReRAG filters at retrieval: embeddings live in a vec0 virtual table inside SQLite, a KNN cosine search returns candidates, Keto enforces per-document relationships, and only authorized snippets are passed to the LLM. The demo (llama3.2:1b for inference, nomic-embed-text for embeddings) illustrates correct multi-tenant behavior (Alice sees John Doe’s refund, Bob sees ABC Corp’s, bad-actor sees nothing), preventing cross-tenant data leakage and prompt-injection attacks while producing auditable permission checks. Technically notable: sqlite-vec enables native SQL KNN with no full-vector memory load and automatic indexing; an adaptive recursive search doubles the candidate pool when permission filtering removes results (safety cap = 10 attempts) to balance completeness and efficiency in sparse-permission corpora. The stack is Go-based (requires CGO), runs locally in Docker, and supports optional TLS and SQLCipher encryption. It’s intended as a hackable reference (not production): swap storage for Pinecone/pgvector, add OIDC/OAuth2, or implement ANN indexes (HNSW) for larger datasets.