SpiceDB and Testcontainers enable automated, end-to-end permission testing for RAG pipelines to prevent unauthorized data leakage. SpiceDB implements Google's Zanzibar authorization model using Relationship-Based Access Control (ReBAC), while Testcontainers spins up isolated, production-grade SpiceDB instances for each test
Table of contents
Quick Primer on AuthorizationAccess Control for RAGSpin Up Real Authorization for Every TestUsing SpiceDB & TestcontainersEnd-to-End Permission Checks in a Single TestWhat If Your RAG Pipeline Isn’t in Go?Why This Approach MattersTry It YourselfSort: