Recheck document permissions when retrieval evidence is consumed

Associate chunks and embeddings with canonical source-document identity, version and policy metadata. Scope candidate search to authorized data where supported, but verify that the filter is authoritative and fresh under the chosen system. If candidate IDs are fetched before final authorization, do not expose restricted content, sensitive metadata or scores to the model or user along that path. Rerankers, document fetches, citation previews and debugging traces can all become separate disclosure points.

The authorization service should evaluate the authenticated principal, tenant, read action and current document policy. An ACL copied into an index at ingestion can become stale; a periodic refresh has a delay that must be measured and accepted explicitly. State whether a request uses a policy snapshot or rechecks before context construction and response delivery. No sequence of independent checks automatically creates a transaction spanning the policy store, retriever, model and client; stronger revocation semantics require a coordinated design.

A semantic answer cache can serve the same question to different principals, while a prefix cache can retain previously constructed evidence. Partition by appropriate tenant and representation versions, retain source-document provenance, and reauthorize the documents supporting a cached result under the declared freshness policy. Merely adding tenant ID to a key may be insufficient when users within that tenant have different permissions. Query-string equality also does not show that the caller can read the prior evidence.

If a derived answer lacks enough provenance to establish its permitted use, reject that reuse or rebuild it under the actual design rather than guessing that a short TTL is adequate. Invalidation, online checks, policy-version keys and leases have different availability and revocation tradeoffs. A TTL bounds age only under correct clocks and cache enforcement; it does not prove instantaneous policy freshness. HTTP cache rules also do not automatically apply to an application semantic cache unless implemented there.

Use a document visible to one principal and denied to another, then warm all relevant caches. Revoke permission while keeping the document and query unchanged. Verify what reaches candidate previews, reranking, prompt construction, final answers and citations under the declared policy. Include a request already in progress and record whether previously released information can be recalled; generally it cannot. A strict contract must define the last revocation check and acknowledge the concurrency boundary it actually enforces.

The cache lab isolates locality while deliberately omitting access policy. Reset and set both C=4,s=4, predict twelve hits among sixteen initial requests, then Play or Step. Reset and set both C=3,s=4 predicts zero initial hits. Edits retain elapsed time and the trace caps at 4,096 requests. The LRU hit is only a residency event: there are no principals, documents, ACL versions, revocations or derived-answer provenance. Its contrast makes clear why a faster reuse path still needs an independent permission decision.