FedRAMP Moderate retrieval architecture with citation integrity for enterprise LLM — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · FedRAMP Moderate · layout spec_first · implementation executed in CI before publish

Technical parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control that resolves this is a Query-Time ACL Retrieval with Citation Integrity, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is FedRAMP Moderate, and the question it actually asks is which NIST 800-53 control does each component satisfy. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

Why this blocks production

Permissions were applied when documents were indexed, the index is refreshed nightly, and citations are whatever the model names. So a revoked user still gets content, a superseded policy is quoted as current, and a citation points at a document that does not contain the claim.

What FedRAMP Moderate specifically requires

FedRAMP is control-by-control. Every component must map to a specific NIST 800-53 Rev 5 control identifier with an implementation statement, and anything crossing the authorisation boundary needs its own justification in the SSP.

The artifact that satisfies it is a control implementation summary mapped to control identifiers. The way teams most often fail it: a component outside the authorisation boundary that nobody documented, found during assessment.

The implementation — Query-time ACL retrieval with citation containment

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the SSP control implementation summary.

"""Retrieval with query-time ACLs, freshness SLO and citation integrity.

Three failures, one surface. Permissions applied at INDEX time go stale the
moment access changes, so a revoked user keeps seeing content through the
model. A stale index answers confidently from a superseded document. And a
citation that does not actually contain the claim is worse than no citation,
because it manufactures confidence.
"""
from dataclasses import dataclass, field


@dataclass
class Doc:
    doc_id: str
    text: str
    version: int
    indexed_at: int
    acl: set = field(default_factory=set)
    superseded_by: str | None = None


class Index:
    def __init__(self, freshness_sue_s: int = 3600):
        self.docs: dict[str, Doc] = {}
        self.freshness_sue_s = freshness_sue_s

    def put(self, doc: Doc) -> None:
        self.docs[doc.doc_id] = doc

    def stale(self, now: int) -> list[str]:
        return sorted(d.doc_id for d in self.docs.values()
                      if now - d.indexed_at > self.freshness_sue_s)

    def search(self, term: str, user_acl: set, now: int) -> list[dict]:
        """ACL is applied HERE, at query time, against live entitlements —
        not baked into the index where it goes stale on the first revocation."""
        hits = []
        for d in self.docs.values():
            if term.lower() not in d.text.lower():
                continue
            if d.superseded_by:
                continue
            if d.acl and not (d.acl & user_acl):
                continue
            hits.append({"doc_id": d.doc_id, "version": d.version,
                         "text": d.text,
                         "stale": now - d.indexed_at > self.freshness_sue_s})
        return sorted(hits, key=lambda h: h["doc_id"])


def verify_citations(answer: str, citations: list, index: Index) -> dict:
    """A citation must contain a claim-bearing span of the answer. This is a
    containment check, not a similarity score — a loose threshold here is how
    plausible-but-unsupported citations get through."""
    supported, unsupported = [], []
    sentences = [s.strip() for s in answer.split(".") if s.strip()]
    for cite in citations:
        doc = index.docs.get(cite)
        if not doc:
            unsupported.append({"cite": cite, "reason": "cited doc not in index"})
            continue
        if any(s.lower() in doc.text.lower() for s in sentences):
            supported.append(cite)
        else:
            unsupported.append({"cite": cite,
                                "reason": "no cited span appears in the document"})
    return {"supported": supported, "unsupported": unsupported,
            "trustworthy": not unsupported}


if __name__ == "__main__":
    idx = Index(freshness_sue_s=3600)
    idx.put(Doc("d1", "Refunds are processed within 14 days", 7,
                indexed_at=0, acl={"finance"}))
    idx.put(Doc("d2", "Refunds are processed within 30 days", 3,
                indexed_at=0, acl={"finance"}, superseded_by="d1"))
    idx.put(Doc("d3", "Public holiday schedule", 1, indexed_at=0))

    # Entitlement is checked at query time.
    allowed = idx.search("refunds", user_acl={"finance"}, now=10)
    assert [h["doc_id"] for h in allowed] == ["d1"], allowed
    denied = idx.search("refunds", user_acl={"marketing"}, now=10)
    assert denied == [], denied

    # Revocation takes effect immediately, with no reindex.
    idx.docs["d1"].acl = {"finance-restricted"}
    assert idx.search("refunds", user_acl={"finance"}, now=10) == []

    # Superseded documents never surface.
    assert all(h["doc_id"] != "d2" for h in
               idx.search("refunds", user_acl={"finance-restricted"}, now=10))

    # Staleness is reported rather than silently served as current.
    assert idx.stale(now=10) == []
    assert set(idx.stale(now=10_000)) == {"d1", "d2", "d3"}
    hits = idx.search("refunds", user_acl={"finance-restricted"}, now=10_000)
    assert hits and hits[0]["stale"] is True, hits

    good = verify_citations("Refunds are processed within 14 days.", ["d1"], idx)
    assert good["trustworthy"], good
    bad = verify_citations("Refunds are processed within 2 days.", ["d1"], idx)
    assert not bad["trustworthy"], bad
    missing = verify_citations("Anything.", ["d99"], idx)
    assert missing["unsupported"][0]["reason"] == "cited doc not in index"

    print("Query-time ACL retrieval + citation integrity: OK")
    print(f"  stale docs at t=10000: {len(idx.stale(10_000))}, "
          f"citation trustworthy good={good['trustworthy']} bad={bad['trustworthy']}")

The FedRAMP Moderate control, as code

NIST 800-53 control map with a boundary-crossing check. This is the artifact an assessor asks for under FedRAMP Moderate specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""NIST 800-53 control satisfaction map with an authorisation-boundary check.

FedRAMP reviewers do not ask whether the system is secure. They ask which
control, by identifier, each component satisfies, and what crosses the
authorisation boundary. An external model endpoint is a boundary crossing, and
an undeclared crossing is the finding that stalls an ATO.
"""

MODERATE_BASELINE = {
    "AC-4": "Information flow enforcement",
    "AU-2": "Event logging",
    "AU-9": "Protection of audit information",
    "CA-3": "Information exchange / external connections",
    "SC-7": "Boundary protection",
    "SC-8": "Transmission confidentiality and integrity",
    "SC-28": "Protection of information at rest",
    "SI-4": "System monitoring",
}


class AuthorisationBoundary:
    def __init__(self, name: str):
        self.name = name
        self.components: dict[str, dict] = {}
        self.crossings: list[dict] = []

    def declare(self, component: str, inside: bool, controls: list[str]) -> None:
        unknown = [c for c in controls if c not in MODERATE_BASELINE]
        if unknown:
            raise KeyError(f"not in the Moderate baseline: {unknown}")
        self.components[component] = {"inside": inside, "controls": set(controls)}

    def connect(self, src: str, dst: str, declared: bool) -> None:
        for end in (src, dst):
            if end not in self.components:
                raise KeyError(f"undeclared component: {end}")
        crossing = self.components[src]["inside"] != self.components[dst]["inside"]
        self.crossings.append({"src": src, "dst": dst,
                               "boundary_crossing": crossing, "declared": declared})

    def undeclared_crossings(self) -> list[dict]:
        return [c for c in self.crossings if c["boundary_crossing"] and not c["declared"]]

    def coverage(self) -> dict:
        covered = set()
        for meta in self.components.values():
            covered |= meta["controls"]
        gaps = sorted(set(MODERATE_BASELINE) - covered)
        return {"covered": sorted(covered), "gaps": gaps,
                "ato_ready": not gaps and not self.undeclared_crossings()}


if __name__ == "__main__":
    b = AuthorisationBoundary("agency-llm-enclave")
    b.declare("gateway", True, ["AC-4", "SC-7", "SC-8"])
    b.declare("audit_store", True, ["AU-2", "AU-9", "SC-28"])
    b.declare("monitor", True, ["SI-4"])
    b.declare("external_model_api", False, ["CA-3"])

    b.connect("gateway", "audit_store", declared=True)
    b.connect("gateway", "external_model_api", declared=True)
    cov = b.coverage()
    assert cov["ato_ready"], cov
    assert cov["gaps"] == [], cov

    # The finding this exists to catch: a crossing nobody declared.
    b2 = AuthorisationBoundary("agency-llm-enclave")
    b2.declare("gateway", True, list(MODERATE_BASELINE))
    b2.declare("telemetry_sidecar", False, ["CA-3"])
    b2.connect("gateway", "telemetry_sidecar", declared=False)
    assert not b2.coverage()["ato_ready"], b2.coverage()
    assert len(b2.undeclared_crossings()) == 1, b2.undeclared_crossings()

    try:
        b2.declare("rogue", True, ["XX-1"])
        raise AssertionError("accepted a control outside the baseline")
    except KeyError:
        pass

    print("FedRAMP Moderate boundary + control map: OK")
    print(f"  controls covered {len(cov['covered'])}/{len(MODERATE_BASELINE)}, "
          f"undeclared crossings {len(b2.undeclared_crossings())}")

The request path

Query-Time ACL Retrieval with Citation Integrity — the request path, with the decision points that must exist before the first model call:

flowchart LR
    Q[Query + live entitlements] --> SRCH[Search index]
    SRCH --> ACL{ACL match at query time?}
    ACL -->|no| DROP[Drop silently from results]
    ACL -->|yes| SUP{Superseded?}
    SUP -->|yes| DROP
    SUP -->|no| FRESH[Attach version + staleness]
    FRESH --> ANS[Answer + citations]
    ANS --> VER{Cited doc contains the claim?}
    VER -->|no| STRIP[Refuse the citation]
    VER -->|yes| OUT[Answer with verified citations]

Modular implementation framework

1. Query-time ACL — Entitlements evaluated per query against live rights, never baked in.
2. Supersession links — A replaced document is unreachable, not merely lower-ranked.
3. Freshness SLO — Index age per document, with staleness reported on the hit.
4. Citation containment — A cited document must contain a claim-bearing span of the answer.
5. Provenance on the hit — Document id and version travel with the retrieved text.
6. Revocation path — An entitlement change takes effect without a reindex.

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Review questions and answers

• Which NIST 800-53 control does each component satisfy, and which components sit outside the authorisation boundary?
  Each component carries its control identifiers in configuration, and the boundary diagram is generated from that configuration so it cannot drift from reality.
• A user's access is revoked at 09:00. When does the model stop retrieving that content for them?
  On their next query. Entitlements are evaluated at query time against live rights, so revocation does not wait for a reindex — which is the whole reason index-time ACLs fail.
• What stops a superseded policy document being quoted as current?
  Supersession links. A replaced document is unreachable in search rather than ranked lower, so it cannot surface as a near-miss when the replacement is less similar.
• How do you know a citation actually supports the sentence it is attached to?
  A containment check: a claim-bearing span of the answer must appear in the cited document. A citation that fails is refused, because an unsupported citation manufactures confidence.
• How does a reader know whether the retrieved content is current?
  Every hit carries its document version and a staleness flag derived from the freshness SLO, so content older than the agreed window is visibly old rather than silently current.
• Can a restricted document influence results through similarity without being shown?
  No. Restricted documents are filtered during the scan, before ranking, so they never contribute to the candidate set a user may not read.

Related architectures

• Part of enterprise ai compliance architecture.
• fedRAMP Moderate reference architecture for enterprise LLM deployment applies the same mechanism under a different obligation.
• fedRAMP Moderate audit evidence architecture for enterprise LLM deployment applies the same mechanism under a different obligation.
• This pattern also governs fedRAMP Moderate prompt injection defence architecture for enterprise LLM.
• Where this interacts with another regime, see fedRAMP Moderate vendor evaluation criteria for enterprise AI.
• If this is the blocker in front of you: enterprise AI infrastructure review.