RBAC and audit trails show up as bullet points on every RAG vendor's website — but almost none show the actual enforcement. This post walks through what permission-aware retrieval really looks like at the database layer, using PostgreSQL and pgvector, and gives security teams a concrete checklist for verifying any vendor's claims before signing.