ISO/IEC 27001:2022 retrieval architecture with citation integrity for enterprise LLM — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · ISO/IEC 27001:2022 · layout diagram_first · implementation executed in CI before publish

The control that resolves this is a Query-Time ACL Retrieval with Citation Integrity, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is ISO/IEC 27001:2022, and the question it actually asks is is this risk on the register with a named owner and a treatment. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The blueprint

Query-Time ACL Retrieval with Citation Integrity — the request path, with the decision points that must exist before the first model call:

flowchart LR
    Q[Query + live entitlements] --> SRCH[Search index]
    SRCH --> ACL{ACL match at query time?}
    ACL -->|no| DROP[Drop silently from results]
    ACL -->|yes| SUP{Superseded?}
    SUP -->|yes| DROP
    SUP -->|no| FRESH[Attach version + staleness]
    FRESH --> ANS[Answer + citations]
    ANS --> VER{Cited doc contains the claim?}
    VER -->|no| STRIP[Refuse the citation]
    VER -->|yes| OUT[Answer with verified citations]

Modular implementation framework

1. Query-time ACL — Entitlements evaluated per query against live rights, never baked in.
2. Supersession links — A replaced document is unreachable, not merely lower-ranked.
3. Freshness SLO — Index age per document, with staleness reported on the hit.
4. Citation containment — A cited document must contain a claim-bearing span of the answer.
5. Provenance on the hit — Document id and version travel with the retrieved text.
6. Revocation path — An entitlement change takes effect without a reindex.

Deployment parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Why this blocks production

Permissions were applied when documents were indexed, the index is refreshed nightly, and citations are whatever the model names. So a revoked user still gets content, a superseded policy is quoted as current, and a citation points at a document that does not contain the claim.

What ISO/IEC 27001:2022 specifically requires

ISO 27001 is a management-system standard: the auditor checks that risks are identified, owned, treated and reviewed on a cycle. A perfect technical control that is absent from the risk register is a nonconformity.

The artifact that satisfies it is risk register entries with owners, treatments and review dates. The way teams most often fail it: a technically sound control that no Statement of Applicability references, so it cannot be evidenced.

Implementation artifact — Query-time ACL retrieval with citation containment

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the Statement of Applicability extract.

"""Retrieval with query-time ACLs, freshness SLO and citation integrity.

Three failures, one surface. Permissions applied at INDEX time go stale the
moment access changes, so a revoked user keeps seeing content through the
model. A stale index answers confidently from a superseded document. And a
citation that does not actually contain the claim is worse than no citation,
because it manufactures confidence.
"""
from dataclasses import dataclass, field


@dataclass
class Doc:
    doc_id: str
    text: str
    version: int
    indexed_at: int
    acl: set = field(default_factory=set)
    superseded_by: str | None = None


class Index:
    def __init__(self, freshness_sue_s: int = 3600):
        self.docs: dict[str, Doc] = {}
        self.freshness_sue_s = freshness_sue_s

    def put(self, doc: Doc) -> None:
        self.docs[doc.doc_id] = doc

    def stale(self, now: int) -> list[str]:
        return sorted(d.doc_id for d in self.docs.values()
                      if now - d.indexed_at > self.freshness_sue_s)

    def search(self, term: str, user_acl: set, now: int) -> list[dict]:
        """ACL is applied HERE, at query time, against live entitlements —
        not baked into the index where it goes stale on the first revocation."""
        hits = []
        for d in self.docs.values():
            if term.lower() not in d.text.lower():
                continue
            if d.superseded_by:
                continue
            if d.acl and not (d.acl & user_acl):
                continue
            hits.append({"doc_id": d.doc_id, "version": d.version,
                         "text": d.text,
                         "stale": now - d.indexed_at > self.freshness_sue_s})
        return sorted(hits, key=lambda h: h["doc_id"])


def verify_citations(answer: str, citations: list, index: Index) -> dict:
    """A citation must contain a claim-bearing span of the answer. This is a
    containment check, not a similarity score — a loose threshold here is how
    plausible-but-unsupported citations get through."""
    supported, unsupported = [], []
    sentences = [s.strip() for s in answer.split(".") if s.strip()]
    for cite in citations:
        doc = index.docs.get(cite)
        if not doc:
            unsupported.append({"cite": cite, "reason": "cited doc not in index"})
            continue
        if any(s.lower() in doc.text.lower() for s in sentences):
            supported.append(cite)
        else:
            unsupported.append({"cite": cite,
                                "reason": "no cited span appears in the document"})
    return {"supported": supported, "unsupported": unsupported,
            "trustworthy": not unsupported}


if __name__ == "__main__":
    idx = Index(freshness_sue_s=3600)
    idx.put(Doc("d1", "Refunds are processed within 14 days", 7,
                indexed_at=0, acl={"finance"}))
    idx.put(Doc("d2", "Refunds are processed within 30 days", 3,
                indexed_at=0, acl={"finance"}, superseded_by="d1"))
    idx.put(Doc("d3", "Public holiday schedule", 1, indexed_at=0))

    # Entitlement is checked at query time.
    allowed = idx.search("refunds", user_acl={"finance"}, now=10)
    assert [h["doc_id"] for h in allowed] == ["d1"], allowed
    denied = idx.search("refunds", user_acl={"marketing"}, now=10)
    assert denied == [], denied

    # Revocation takes effect immediately, with no reindex.
    idx.docs["d1"].acl = {"finance-restricted"}
    assert idx.search("refunds", user_acl={"finance"}, now=10) == []

    # Superseded documents never surface.
    assert all(h["doc_id"] != "d2" for h in
               idx.search("refunds", user_acl={"finance-restricted"}, now=10))

    # Staleness is reported rather than silently served as current.
    assert idx.stale(now=10) == []
    assert set(idx.stale(now=10_000)) == {"d1", "d2", "d3"}
    hits = idx.search("refunds", user_acl={"finance-restricted"}, now=10_000)
    assert hits and hits[0]["stale"] is True, hits

    good = verify_citations("Refunds are processed within 14 days.", ["d1"], idx)
    assert good["trustworthy"], good
    bad = verify_citations("Refunds are processed within 2 days.", ["d1"], idx)
    assert not bad["trustworthy"], bad
    missing = verify_citations("Anything.", ["d99"], idx)
    assert missing["unsupported"][0]["reason"] == "cited doc not in index"

    print("Query-time ACL retrieval + citation integrity: OK")
    print(f"  stale docs at t=10000: {len(idx.stale(10_000))}, "
          f"citation trustworthy good={good['trustworthy']} bad={bad['trustworthy']}")

The ISO/IEC 27001:2022 control, as code

Statement of Applicability with operating evidence. This is the artifact an assessor asks for under ISO/IEC 27001:2022 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Annex A control to evidence mapping behind a Statement of Applicability.

ISO/IEC 27001:2022 turns on the SoA: every Annex A control is either applicable
with a justification and evidence, or excluded with a justification. The audit
failure is an applicable control whose evidence is a policy document rather
than a record that the control operated.
"""

ANNEX_A_2022 = {
    "A.5.23": "Information security for use of cloud services",
    "A.8.2": "Privileged access rights",
    "A.8.10": "Information deletion",
    "A.8.12": "Data leakage prevention",
    "A.8.15": "Logging",
    "A.8.16": "Monitoring activities",
    "A.8.24": "Use of cryptography",
    "A.8.28": "Secure coding",
}

EVIDENCE_KINDS = {"record", "configuration", "test_result"}
NON_EVIDENCE = {"policy", "intent", "roadmap"}


class StatementOfApplicability:
    def __init__(self, scope: str):
        self.scope = scope
        self.entries: dict[str, dict] = {}

    def apply(self, control: str, justification: str,
              evidence_ref: str, evidence_kind: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if evidence_kind in NON_EVIDENCE:
            raise ValueError(
                f"{control}: {evidence_kind!r} describes intent, not operation")
        if evidence_kind not in EVIDENCE_KINDS:
            raise ValueError(f"{control}: unknown evidence kind {evidence_kind!r}")
        self.entries[control] = {"applicable": True, "justification": justification,
                                 "evidence_ref": evidence_ref,
                                 "evidence_kind": evidence_kind}

    def exclude(self, control: str, justification: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if len(justification.split()) < 5:
            raise ValueError(f"{control}: exclusion needs a real justification")
        self.entries[control] = {"applicable": False, "justification": justification}

    def unaddressed(self) -> list[str]:
        return sorted(set(ANNEX_A_2022) - set(self.entries))

    def certifiable(self) -> dict:
        gaps = self.unaddressed()
        applied = [c for c, e in self.entries.items() if e["applicable"]]
        return {"scope": self.scope, "applied": sorted(applied),
                "excluded": sorted(c for c, e in self.entries.items()
                                   if not e["applicable"]),
                "unaddressed": gaps, "certifiable": not gaps}


if __name__ == "__main__":
    soa = StatementOfApplicability("LLM platform, production tenant")
    soa.apply("A.5.23", "Model inference is a cloud service",
              "cfg://gateway/allowed-providers.yaml", "configuration")
    soa.apply("A.8.2", "Operators hold privileged access to prompts",
              "rec://iam/quarterly-access-review-2026Q3", "record")
    soa.apply("A.8.10", "Retention is enforced on prompt logs",
              "test://retention/expiry-suite-2026-10", "test_result")
    soa.apply("A.8.12", "Egress to model providers can leak data",
              "cfg://dlp/egress-classifier.yaml", "configuration")
    soa.apply("A.8.15", "All inference events are logged",
              "rec://audit/chain-head-2026-10-16", "record")
    soa.apply("A.8.16", "Anomalous usage is monitored",
              "rec://siem/llm-usage-alerts", "record")
    soa.apply("A.8.24", "TLS and at-rest encryption",
              "test://crypto/tls-config-scan", "test_result")
    soa.exclude("A.8.28", "No application code is developed within this scope "
                          "boundary; the platform is configured, not coded")

    report = soa.certifiable()
    assert report["certifiable"], report
    assert len(report["applied"]) == 7 and len(report["excluded"]) == 1, report

    try:
        soa.apply("A.8.15", "we have a logging policy",
                  "doc://policies/logging.pdf", "policy")
        raise AssertionError("accepted a policy document as operating evidence")
    except ValueError:
        pass

    partial = StatementOfApplicability("partial")
    partial.apply("A.8.15", "logging", "rec://x", "record")
    assert not partial.certifiable()["certifiable"]
    assert len(partial.certifiable()["unaddressed"]) == 7

    print("ISO/IEC 27001:2022 SoA evidence mapping: OK")
    print(f"  applied {len(report['applied'])}, excluded {len(report['excluded'])}, "
          f"unaddressed {len(report['unaddressed'])}")

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

What the auditor will ask

• Where is this control in the risk register and the Statement of Applicability, who owns it, and when was it last reviewed?
  Register entries are generated from the deployed control set, so every control has an SoA reference, a named owner and a review date that cannot silently lapse.
• A user's access is revoked at 09:00. When does the model stop retrieving that content for them?
  On their next query. Entitlements are evaluated at query time against live rights, so revocation does not wait for a reindex — which is the whole reason index-time ACLs fail.
• What stops a superseded policy document being quoted as current?
  Supersession links. A replaced document is unreachable in search rather than ranked lower, so it cannot surface as a near-miss when the replacement is less similar.
• How do you know a citation actually supports the sentence it is attached to?
  A containment check: a claim-bearing span of the answer must appear in the cited document. A citation that fails is refused, because an unsupported citation manufactures confidence.
• How does a reader know whether the retrieved content is current?
  Every hit carries its document version and a staleness flag derived from the freshness SLO, so content older than the agreed window is visibly old rather than silently current.
• Can a restricted document influence results through similarity without being shown?
  No. Restricted documents are filtered during the scan, before ranking, so they never contribute to the candidate set a user may not read.

Adjacent problems

• Part of enterprise ai compliance architecture.
• This pattern also governs fedRAMP Moderate retrieval architecture with citation integrity.
• Where this interacts with another regime, see EU AI Act retrieval architecture with citation integrity for enterprise.
• HIPAA retrieval architecture with citation integrity for enterprise LLM covers the adjacent case.
• For the related constraint, see SOX retrieval architecture with citation integrity for enterprise LLM.
• If this is the blocker in front of you: enterprise AI infrastructure review.