Authentication and Authorization in Vector Systems

A vector database contains your company's "Brain"—proprietary documents, customer chat history, and internal secrets. If an attacker gains access to your database, they can use sematic search to efficiently find your most sensitive information.

In this lesson, we learn how to lock down the front door using Authentication and Authorization.

---

1. Authentication (AuthN): Who are you?

Most vector databases use one of two methods to prove identity:

• API Keys: Simple and effective. You include an X-Api-Key header in your requests.
  • Risk: If the key is leaked in a GitHub repo, your database is wide open.
• IAM Roles (Identity & Access Management): Used in cloud environments like AWS (OpenSearch) or Google (Vertex AI Search).
  • Benefit: No keys to leak. The server's identity is verified by the cloud provider.

---

2. Authorization (AuthZ): What can you do?

Just because a user is "Authenticated" doesn't mean they should be able to "Delete" an index. Use RBAC (Role-Based Access Control):

1. Reader: Can only perform query and get.
2. Writer: Can upsert and update.
3. Admin: Can create_index, delete_index, and manage_api_keys.

---

3. The "Middleman" Pattern

Crucial Security Rule: Never allow your Frontend (React/Web) to talk directly to your Vector Database.

A user could inspect the network traffic, find your API key, and run a script to download all your vectors. Instead, always use a Backend API (Python/FastAPI) as a middleman.

graph LR
    U[User Browser] --"JWT token"--> API[FastAPI Middleware]
    API --"API Key"--> V[(Vector DB)]
    note bottom of API: Middleware validates user permissions<br/>before searching.

---

4. Implementation: API Key Hygiene (Python)

Never hardcode your keys. Use environment variables and secret managers.

import os
from pinecone import Pinecone

# WRONG:
# pc = Pinecone(api_key="12345-abcde")

# RIGHT:
api_key = os.environ.get("PINECONE_API_KEY")
if not api_key:
    raise ValueError("Missing Vector DB Credentials!")

pc = Pinecone(api_key=api_key)

---

5. Summary and Key Takeaways

1. Defense in Depth: Use API keys AND network isolation (VPC).
2. RBAC: Apply the "Principle of Least Privilege." Don't give your "Search App" the "Admin" key.
3. Middleware is Mandatory: Always proxy vector requests through your own backend to enforce business logic.
4. Credential Rotation: Rotate your API keys every 90 days to minimize the window for attackers.

In the next lesson, we’ll move deeper into the data itself: Securing Embeddings.

---

Congratulations on completing Module 16 Lesson 1! You are now securing the AI mind.