Permission-aware data access

Authorization must survive transformation

Permission-aware access begins at the authoritative source and continues through extraction, chunking, enrichment, indexing, retrieval, caching, generation, export, and evidence. Applying one filter only after retrieval risks exposing content through ranking, snippets, caches, logs, or generated answers.

Access model

For every knowledge object, preserve:

• Stable source and content identifiers.
• Owner, tenant, project, classification, and lifecycle state.
• Source authorization attributes or an authoritative reference to them.
• Version, effective time, deletion state, and transformation lineage.
• The policy version used to make an access decision.

Choose whether permissions are copied into the index, resolved at query time, or combined. Copied permissions improve local availability but can become stale. Query-time checks are current but add dependencies and latency. Document reconciliation and failure behavior either way.

Retrieval enforcement

Authenticate the requester, establish purpose and context, derive the permitted candidate set, then rank only within that set. Apply the same constraints to keyword, vector, graph, metadata, hybrid, reranking, cache, and follow-up retrieval paths.

Do not ask a language model to enforce access control from instructions. Authorization must be deterministic and testable outside model behavior.

Change and deletion

Define how group membership, source permissions, classification, legal holds, deletion, and source updates propagate. Measure maximum acceptable staleness and block or degrade safely when authorization state cannot be trusted.

Verification cases

Test allowed, denied, mixed-permission, cross-tenant, stale-membership, deleted-document, cache, citation, inference, and administrative paths. Confirm that denied content is absent from retrieved context, answer text, citations, logs, evaluation samples, and debug interfaces.

Retain decision reason, policy and content versions, requester context, and result metadata while minimizing sensitive content in operational evidence.