Retrieval access control: enforce permission before evidence reaches a consumer

Authenticate the requesting principal and obtain its current tenant, group, purpose, or other policy attributes from trusted application state. Use them to define eligible source records under the current access policy. Retrieval should operate within that eligible domain where the chosen index supports it, and fetched content must still be checked before serving or model use. Post-filtering a global top-k list can remove unauthorized hits but also leave too few useful authorized results; it is not automatically equivalent to ranking the eligible corpus.

A prompt saying use only public documents does not replace a data authorization check. Retrieved text is evidence input, not permission to expand access or execute its embedded instructions. PostgreSQL 18 row security and Elasticsearch 8.19 document-level security are examples of enforcement mechanisms with specific role and query semantics. PostgreSQL superusers, BYPASSRLS roles, and normally table owners have documented bypass behavior. Test the actual service identity and configuration rather than assuming an enabled feature constrains every code path.

Check parent expansion, neighboring passages, hierarchical summaries, reranking services, fallback queries, exports, and citation-resolution endpoints. A permitted child does not authorize a restricted parent region. A summary derived from mixed-access sources can reveal restricted content even if its own record lacks the original labels. Define and enforce a derived-content policy using lineage, or regenerate a permitted derivation. Cache entries containing snippets, source identifiers, or generated answers need equivalent scope checks; a query string alone is not a safe cross-user key.

Revocation can race retrieval or cache lookup. Choose a policy for in-flight requests and a point at which a current permission decision must be established before delivery, using an implementation that supports that consistency goal. Merely writing an ACL version into a log does not make the decision atomic. On permission uncertainty, refresh or deny the affected artifact according to policy. Deleting an index row does not necessarily remove material from parent stores, answer caches, derived summaries, or a previously generated response buffer.

Build cases for two tenants with identical query text, a user losing a group, a source changing permissions without changing content, and a cache populated by a more privileged principal. Verify every retrieval variant and citation endpoint. Test broad database roles and role combinations using their actual documented semantics. Observe content delivered to rerankers and generation providers as well as the final user response. A denied visible answer does not repair a restricted passage already sent to an unauthorized downstream consumer.

The probability lab provides only a negative-test counting analogy. Reset, set p=0 and n=20, predict zero successes with probability one, then Play or Step. Separately Reset, set p=0.05 and n=20, predict mean one success and probability of zero successes about 0.3585, then Play or Step. It does not implement permissions or simulate attacks. Under an explicitly independent hypothetical defect model, zero observed failures does not prove the defect probability is zero; access invariants still need deterministic path coverage and actual policy tests.