The Corporate Memory Firewall: Inside FSx-for-ONTAP-Agentic-Access-Aware-RAG

How a NetApp architect bridged the gap between legacy NTFS file permissions and modern AWS Bedrock agents to stop LLMs from leaking corporate secrets.

8 min read • View on GitHub • More from Yoshiki0705

A massive bank vault door where the combination dial is a glowing neural network node, but the locking bars and hinges are heavy traditional iron hardware covered in physical padlocks. — Access-Aware RAG secures modern AI capabilities behind battle-tested, traditional infrastructure.

Hi I'm Yoshiki, live in Tokyo, Japan. I work as a Cloud Solution Architect now and please feel free to contact me if you have any question or suggestion

Yoshiki Fujiwara, Cloud Solution Architect, NetApp G.K. Japan · Yoshiki Fujiwara (@Yoshiki0705)

Key Takeaways

Standard RAG implementations are a compliance liability because they routinely bypass application-level access controls.
The repository solves this by using the ONTAP REST API to scrape Windows Security Identifiers (SIDs) and injecting them as metadata into OpenSearch.
A zero-touch provisioning bridge automatically syncs a user's Active Directory groups into a DynamoDB cache at login.
The Next.js frontend actively displays the user's accessible directories to build trust in the agent's constrained reasoning.

The Hallucination We Ignore: Data Leakage

The wild west era of Generative AI is ending. For AI to actually work in enterprise environments, it cannot just ingest everything and answer everyone. It must respect the decades-old infrastructure of Active Directory and NTFS file permissions.

Imagine an intern asking the corporate AI for the CEO's compensation package. Standard Retrieval-Augmented Generation (RAG) will happily summarize it if the document exists in the vector database. The system must translate legacy file system security into modern LLM vector filtering. This repository acts as a Rosetta Stone for that exact problem.

Amazon FSx for NetApp ONTAP と Amazon Bedrock を使って、アクセス制御対応の Agentic RAG を AWS CDK でデプロイするサンプル / AWS CDK sample for deploying access-aware agentic RAG with Amazon FSx for NetApp ONTAP and Amazon Bedrock

Yoshiki0705/FSx-for-ONTAP-Agentic-Access-Aware-RAG, GitHub Repository Description · FSx-for-ONTAP-Agentic-Access-Aware-RAG

Translating Legacy Security to Vector Metadata

The codebase is an AWS CDK monorepo. The most critical component lives in the `docker/embed/src/index.ts` file. This service mounts the FSx ONTAP volume via SMB and uses the ONTAP REST API to read NTFS Access Control Lists (ACLs).

It converts these ACLs into a `.metadata.json` file for every document. This metadata explicitly lists the Security Identifiers (SIDs) allowed to view the chunk. By injecting this metadata into OpenSearch Serverless, the system ensures that vector retrieval is pre-filtered at the database level.

The SID-to-Vector Pre-Filtering Pipeline ensures authorization happens before the LLM sees any data.

Zero-Touch Provisioning at Login

Managing permissions manually for an AI tool is a non-starter for IT departments. This project implements a zero-touch provisioning pattern. When an employee logs in via SAML and Amazon Cognito, a post-authentication Lambda trigger automatically catches their Active Directory group memberships.

These SIDs are cached in Amazon DynamoDB. The AI team never has to manually sync permissions. The AI's security model is always perfectly aligned with the corporate directory.

An Interface That Shows Its Work

The frontend is a Next.js 15 application running on Lambda Web Adapter. It goes beyond a simple chat interface by explicitly showing the user which FSx directories they are allowed to query. This transparency is crucial for an agentic UI.

Standard RAG vs. Access-Aware RAG

Naive RAG approaches often retrieve all relevant documents and ask the LLM to filter them based on user context. This is fundamentally insecure. Access-Aware RAG pre-filters the vector retrieval itself.

A split composition showing a blindfolded robot grabbing random papers on the left, and a robot with a jeweler's loupe inspecting a security badge on a folder on the right. — Standard retrieval relies on blind trust, while Access-Aware retrieval inspects credentials before touching the data.

Retrieval Stage	Standard RAG	Access-Aware RAG (OpenSearch)
Security Guarantee	Low (Post-filtering by LLM)	High (Pre-filtering at Database)
Infrastructure Complexity	Low	High (Requires Metadata Sync)
Identity Integration	None	Deep (Active Directory SIDs)

By bridging the gap between legacy NTFS permissions and modern vector databases, this architecture proves you do not need to rebuild your corporate authorization matrix from scratch to safely deploy an AI agent.