Permission-aware retrieval, or how not to leak the salary sheet

An assistant that indexes everything and answers everyone is a data-leak incident with a chat interface.

Filter in the query, never after

Fetching the top passages and then dropping the ones the user may not see looks equivalent and is not. It leaks through result counts, through latency, and through the moment someone forgets the post-filter on a new endpoint. The permission scope belongs in the vector query itself.

Carry the source system's ACL

Most documents already have an owner and an audience in the system they came from. Ingest that alongside the text and keep it in sync — a file that moves to a restricted folder must drop out of retrieval on the next sync, not the next re-index.

Re-check at answer time

Permissions change between ingestion and the question being asked. The check that matters is the one at query time, against the actor resolved from the session — never against an identifier the client supplied.

Log the identifiers, not the content

An audit trail needs to record who asked, what was retrieved, and which sources were cited. It does not need the passage text, and storing it turns your log store into a second copy of the sensitive data.