Search RAG Ingestion
Search RAG - Ingestion - Permission Handling
Permissions are a retrieval constraint, not a post-filter.
Why this matters in production
Post-filtering looks attractive because it is easy: retrieve everything, remove what the user cannot see, then answer. This works until restricted evidence influences ranking before it is removed.
This is usually a mistake: treating access control as a document-display concern. In RAG, anything that shapes the candidate pool can leak information.
What breaks
Unauthorized chunks can boost related public chunks. Private titles can influence generated queries. Restricted aliases can connect a user to concepts they should not know exist. The final answer may contain only public text, while the retrieval trace used private structure.
A correct answer from a permission-tainted trace is not safe. The trace is the product.
What works
Resolve permissions before retrieval whenever possible. Store effective ACLs with chunks, propagate source restrictions to derived summaries and generated queries, and never let blocked evidence participate in ranking.
Do not do permission checks only at citation time unless the system is low-risk and the retrieval trace is guaranteed not to influence protected facts.
Practical guidance
Test public-node/private-edge cases, stale ACLs, group membership changes, deleted users, cross-tenant aliases, and generated summaries derived from restricted content.
What happened
A user asked about a public service and received an answer that mentioned an upcoming migration. The cited chunk was public, but the system only retrieved it because a restricted planning document boosted the service alias.
Why retrieval failed
Permission filtering happened after candidate generation, so private evidence shaped ranking even though it was removed before answer assembly.
Why it was hard to detect
The citation looked clean. Only the retrieval trace revealed the restricted planning document in the candidate path.
What fixed it
The fix was pre-retrieval ACL filtering, permission inheritance for aliases and generated queries, and trace audits that fail if restricted evidence influences ranking.
Practical Guidance
Apply permissions before candidate generation.
Propagate ACLs to derived artifacts.
Audit traces, not just final citations.