Graph RAG systems decide what to retrieve by looking at the shape of the graph. Enterprises decide who may see what by ownership and role. These two boundaries rarely line up. In a bank’s customer graph, the densest clusters form around households, and each one mixes payments, lending, risk and support data. Retrieve by community and your assistant will happily walk from a payment into a fraud alert that the person asking was never allowed to see.

I built an open benchmark to measure this: multi-domain enterprise graphs up to 125,000 nodes, role-based permissions, and questions with exactly one correct answer. The results surprised me. Limiting retrieval to the domains a role may see cost no accuracy at all, while an unscoped retriever reached forbidden data on every query. Retrieving by graph community was both less accurate and leaked on 99% of queries. And filtering results after retrieval, the most common fix, still let restricted records decide which answer came first.

You’ll see the benchmark, the numbers, and a simple pattern for Neo4j-backed retrieval: scope before you traverse, keep a shared identity layer, and route only when your router doesn’t miss. Code and data are open.