Retrieval authorization decides which source versions and chunks may become candidates before ranking or model context. The server derives policy from the authenticated principal, tenant, groups, document ACLs, sensitivity, purpose, and time; it never trusts model- or user-supplied filters. The same boundary must cover lexical search, vectors, caches, citations, evaluation, and traces.
Authorization is set intersection:
Rank only within this set. Post-filtering top-k global results both risks leakage and damages authorized recall.
Document ACL relations reference stable principal/group IDs and tenant. Chunks inherit through document version rather than copying ad hoc arrays unless a versioned projection is explicitly maintained. RLS can provide defense in depth; query joins must still use tenant/version keys and suitable indexes.
Use a server-built context that cannot be overridden by request text. Citations use opaque authorized routes that recheck access at click time. Caches key on all policy-relevant context or store only safe derived results.
Prompt injection frequently asks the system to “ignore restrictions” or infer hidden documents. The model never owns retrieval policy. Safe refusal and zero-candidate behavior are deterministic application outcomes. Security evaluation includes canary secrets, cross-tenant probes, revoked access, malicious document instructions, and side-channel review.
Create two tenants, private/group/public documents, revoked membership, superseded version, and predictable canary phrases. Test lexical, vector, hybrid, rerank, cache, citation, export, evaluation, and trace paths. The canary must never appear outside its authorized principal, including result counts/snippets where those leak.
Design an ACL schema and an authorized hybrid candidate view for user, group, and tenant-wide grants.
Acceptance criterion: revoked/cross-tenant documents produce no candidate, snippet, citation, cache hit, or trace content, and legitimate group access remains measurable.