PCI DSS 4.0 retrieval architecture with citation integrity for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · PCI DSS 4.0 · layout diagram_first · implementation executed in CI before publish

The control that resolves this is a Query-Time ACL Retrieval with Citation Integrity, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is PCI DSS 4.0, and the question it actually asks is is cardholder data in scope, and can you prove it is not. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The request path

Query-Time ACL Retrieval with Citation Integrity — the request path, with the decision points that must exist before the first model call:

flowchart LR
    Q[Query + live entitlements] --> SRCH[Search index]
    SRCH --> ACL{ACL match at query time?}
    ACL -->|no| DROP[Drop silently from results]
    ACL -->|yes| SUP{Superseded?}
    SUP -->|yes| DROP
    SUP -->|no| FRESH[Attach version + staleness]
    FRESH --> ANS[Answer + citations]
    ANS --> VER{Cited doc contains the claim?}
    VER -->|no| STRIP[Refuse the citation]
    VER -->|yes| OUT[Answer with verified citations]

The parts you have to build

1. Query-time ACL — Entitlements evaluated per query against live rights, never baked in.
2. Supersession links — A replaced document is unreachable, not merely lower-ranked.
3. Freshness SLO — Index age per document, with staleness reported on the hit.
4. Citation containment — A cited document must contain a claim-bearing span of the answer.
5. Provenance on the hit — Document id and version travel with the retrieved text.
6. Revocation path — An entitlement change takes effect without a reindex.

Enterprise implementation parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control gap

Permissions were applied when documents were indexed, the index is refreshed nightly, and citations are whatever the model names. So a revoked user still gets content, a superseded policy is quoted as current, and a citation points at a document that does not contain the claim.

What PCI DSS 4.0 specifically requires

PCI scope is contagious: any system that stores, processes or transmits cardholder data — or can affect the security of one that does — is in scope. The cheapest control is to keep the model tier out of scope entirely.

The artifact that satisfies it is a segmentation test proving the model tier is out of scope. The way teams most often fail it: a PAN reaching a prompt log, dragging the whole inference tier into PCI scope.

The implementation — Query-time ACL retrieval with citation containment

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the segmentation test report.

"""Retrieval with query-time ACLs, freshness SLO and citation integrity.

Three failures, one surface. Permissions applied at INDEX time go stale the
moment access changes, so a revoked user keeps seeing content through the
model. A stale index answers confidently from a superseded document. And a
citation that does not actually contain the claim is worse than no citation,
because it manufactures confidence.
"""
from dataclasses import dataclass, field


@dataclass
class Doc:
    doc_id: str
    text: str
    version: int
    indexed_at: int
    acl: set = field(default_factory=set)
    superseded_by: str | None = None


class Index:
    def __init__(self, freshness_sue_s: int = 3600):
        self.docs: dict[str, Doc] = {}
        self.freshness_sue_s = freshness_sue_s

    def put(self, doc: Doc) -> None:
        self.docs[doc.doc_id] = doc

    def stale(self, now: int) -> list[str]:
        return sorted(d.doc_id for d in self.docs.values()
                      if now - d.indexed_at > self.freshness_sue_s)

    def search(self, term: str, user_acl: set, now: int) -> list[dict]:
        """ACL is applied HERE, at query time, against live entitlements —
        not baked into the index where it goes stale on the first revocation."""
        hits = []
        for d in self.docs.values():
            if term.lower() not in d.text.lower():
                continue
            if d.superseded_by:
                continue
            if d.acl and not (d.acl & user_acl):
                continue
            hits.append({"doc_id": d.doc_id, "version": d.version,
                         "text": d.text,
                         "stale": now - d.indexed_at > self.freshness_sue_s})
        return sorted(hits, key=lambda h: h["doc_id"])


def verify_citations(answer: str, citations: list, index: Index) -> dict:
    """A citation must contain a claim-bearing span of the answer. This is a
    containment check, not a similarity score — a loose threshold here is how
    plausible-but-unsupported citations get through."""
    supported, unsupported = [], []
    sentences = [s.strip() for s in answer.split(".") if s.strip()]
    for cite in citations:
        doc = index.docs.get(cite)
        if not doc:
            unsupported.append({"cite": cite, "reason": "cited doc not in index"})
            continue
        if any(s.lower() in doc.text.lower() for s in sentences):
            supported.append(cite)
        else:
            unsupported.append({"cite": cite,
                                "reason": "no cited span appears in the document"})
    return {"supported": supported, "unsupported": unsupported,
            "trustworthy": not unsupported}


if __name__ == "__main__":
    idx = Index(freshness_sue_s=3600)
    idx.put(Doc("d1", "Refunds are processed within 14 days", 7,
                indexed_at=0, acl={"finance"}))
    idx.put(Doc("d2", "Refunds are processed within 30 days", 3,
                indexed_at=0, acl={"finance"}, superseded_by="d1"))
    idx.put(Doc("d3", "Public holiday schedule", 1, indexed_at=0))

    # Entitlement is checked at query time.
    allowed = idx.search("refunds", user_acl={"finance"}, now=10)
    assert [h["doc_id"] for h in allowed] == ["d1"], allowed
    denied = idx.search("refunds", user_acl={"marketing"}, now=10)
    assert denied == [], denied

    # Revocation takes effect immediately, with no reindex.
    idx.docs["d1"].acl = {"finance-restricted"}
    assert idx.search("refunds", user_acl={"finance"}, now=10) == []

    # Superseded documents never surface.
    assert all(h["doc_id"] != "d2" for h in
               idx.search("refunds", user_acl={"finance-restricted"}, now=10))

    # Staleness is reported rather than silently served as current.
    assert idx.stale(now=10) == []
    assert set(idx.stale(now=10_000)) == {"d1", "d2", "d3"}
    hits = idx.search("refunds", user_acl={"finance-restricted"}, now=10_000)
    assert hits and hits[0]["stale"] is True, hits

    good = verify_citations("Refunds are processed within 14 days.", ["d1"], idx)
    assert good["trustworthy"], good
    bad = verify_citations("Refunds are processed within 2 days.", ["d1"], idx)
    assert not bad["trustworthy"], bad
    missing = verify_citations("Anything.", ["d99"], idx)
    assert missing["unsupported"][0]["reason"] == "cited doc not in index"

    print("Query-time ACL retrieval + citation integrity: OK")
    print(f"  stale docs at t=10000: {len(idx.stale(10_000))}, "
          f"citation trustworthy good={good['trustworthy']} bad={bad['trustworthy']}")

The PCI DSS 4.0 control, as code

PAN tokenisation and a scope-reduction proof. This is the artifact an assessor asks for under PCI DSS 4.0 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""PAN detection with tokenisation, and a scope-reduction proof.

PCI DSS 4.0 scope is everything that stores, processes or transmits account
data, plus anything connected to it. The cheapest compliance move is not better
controls — it is removing systems from scope. A model gateway that never sees a
PAN is out of scope; one that sees it once is in, along with everything it talks
to.
"""
import hashlib
import re

PAN_RE = re.compile(r"\b(?:\d[ -]?){12,18}\d\b")


def luhn_valid(digits: str) -> bool:
    total, parity = 0, len(digits) % 2
    for i, ch in enumerate(digits):
        d = int(ch)
        if i % 2 == parity:
            d *= 2
            if d > 9:
                d -= 9
        total += d
    return total % 10 == 0


class TokenVault:
    """Format-preserving surrogate. The vault is in scope; nothing it feeds is,
    provided the surrogate is not reversible outside it."""

    def __init__(self, pepper: str):
        self._pepper = pepper
        self._map: dict[str, str] = {}

    def tokenise(self, pan: str) -> str:
        digest = hashlib.sha256(f"{self._pepper}:{pan}".encode()).hexdigest()
        surrogate = "4" + str(int(digest[:15], 16)).zfill(15)[:15]
        self._map[surrogate] = pan
        return surrogate

    def last_four(self, pan: str) -> str:
        return pan[-4:]


class ScopeBoundary:
    def __init__(self):
        self.systems: dict[str, bool] = {}
        self.flows: list[tuple[str, str]] = []

    def add(self, system: str, sees_pan: bool) -> None:
        self.systems[system] = sees_pan

    def flow(self, src: str, dst: str) -> None:
        self.flows.append((src, dst))

    def in_scope(self) -> set[str]:
        scope = {s for s, sees in self.systems.items() if sees}
        changed = True
        while changed:                      # connected-to is also in scope
            changed = False
            for src, dst in self.flows:
                if src in scope and dst not in scope:
                    scope.add(dst); changed = True
                elif dst in scope and src not in scope:
                    scope.add(src); changed = True
        return scope


def redact(text: str, vault: TokenVault) -> tuple[str, int]:
    found = 0
    def _sub(m):
        nonlocal found
        raw = re.sub(r"[ -]", "", m.group(0))
        if not luhn_valid(raw):
            return m.group(0)
        found += 1
        return f"tok_{vault.tokenise(raw)}(last4={vault.last_four(raw)})"
    return PAN_RE.sub(_sub, text), found


if __name__ == "__main__":
    vault = TokenVault(pepper="hsm-managed")
    text = "Charge card 4111 1111 1111 1111 for invoice 9912, ref 1234567890123456"
    out, n = redact(text, vault)
    assert n >= 1 and "4111 1111 1111 1111" not in out, out
    assert "last4=1111" in out, out

    # A number that fails Luhn is not a PAN and must not be mangled.
    benign, n2 = redact("order 1234 5678 9012 3450 placed", vault)
    assert n2 == 0 and "1234 5678 9012 3450" in benign, benign

    sb = ScopeBoundary()
    sb.add("checkout", True); sb.add("token_vault", True)
    sb.add("llm_gateway", False); sb.add("analytics", False)
    sb.flow("checkout", "token_vault"); sb.flow("token_vault", "llm_gateway")
    scope = sb.in_scope()
    assert "llm_gateway" in scope, "connected-to is in scope — that is the point"

    clean = ScopeBoundary()
    clean.add("checkout", True); clean.add("token_vault", True)
    clean.add("llm_gateway", False)
    clean.flow("checkout", "token_vault")
    assert "llm_gateway" not in clean.in_scope(), clean.in_scope()

    print("PCI DSS 4.0 tokenisation + scope reduction: OK")
    print(f"  PANs tokenised {n}, naive scope {len(scope)} systems, "
          f"segmented scope {len(clean.in_scope())} systems")

Risk and control matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Review questions and answers

• Is the inference tier in PCI scope, and what segmentation test proves it is not?
  Cardholder data is tokenised before the model boundary and the segmentation is evidenced by an annual penetration test, so the tier stays out of scope by design.
• A user's access is revoked at 09:00. When does the model stop retrieving that content for them?
  On their next query. Entitlements are evaluated at query time against live rights, so revocation does not wait for a reindex — which is the whole reason index-time ACLs fail.
• What stops a superseded policy document being quoted as current?
  Supersession links. A replaced document is unreachable in search rather than ranked lower, so it cannot surface as a near-miss when the replacement is less similar.
• How do you know a citation actually supports the sentence it is attached to?
  A containment check: a claim-bearing span of the answer must appear in the cited document. A citation that fails is refused, because an unsupported citation manufactures confidence.
• How does a reader know whether the retrieved content is current?
  Every hit carries its document version and a staleness flag derived from the freshness SLO, so content older than the agreed window is visibly old rather than silently current.
• Can a restricted document influence results through similarity without being shown?
  No. Restricted documents are filtered during the scan, before ranking, so they never contribute to the candidate set a user may not read.

Related architectures

• Part of enterprise ai compliance architecture.
• Where this interacts with another regime, see PCI DSS 4.0 legacy integration patterns for enterprise AI agents.
• PCI DSS 4.0 cost control architecture for enterprise LLM deployment covers the adjacent case.
• PCI DSS 4.0 vendor evaluation criteria for enterprise AI implementation applies the same mechanism under a different obligation.
• Where this interacts with another regime, see PCI DSS 4.0 agent permission and delegated access architecture.
• If this is the blocker in front of you: enterprise AI infrastructure review.