How do you keep a RAG system's answers fresh and access-controlled?

Attach metadata to every chunk — source, updated-at, and access permissions — and filter at query time: enforce the user's entitlements and prefer recent versions. Re-embed documents when they change (event-driven or scheduled) rather than re-indexing everything rarely. The two worst RAG incidents in practice — leaking a document to the wrong user and answering from a superseded version — are both metadata-and-pipeline problems, not model problems.