Enforce Knowledge Permissions Before Retrieval

A practical approach

Step 1

Resolve the user’s identity and allowed scope on the server. Do not accept a client-provided team ID as sufficient authorization.

Step 2

Apply access filters when selecting candidates, then verify the scope again before returning sensitive content or taking an action.

Step 3

Partition caches by the permissions that affect the answer. Test users with different access against the same question and source collection.

Worked example

A company assistant serves both trainees and trainers. Trainer notes contain assessment answers, while trainees can read only lesson material. If retrieval pulls both and relies on a prompt to hide the answer key, the boundary is misplaced. The trainee’s retrieval scope should exclude the trainer notes entirely.

A mistake to avoid

A shared answer cache can undo an otherwise correct retrieval filter. An answer produced for a privileged user must not be served to another user solely because their question text matches.

Try it yourself

Create two test users with different document access. Ask the same questions, inspect retrieved source IDs and test cache hits after switching users. Include document-title and citation checks.

Your implementation checklist

• Identity is established on the server.
• Retrieval uses the current authorized scope.
• Caches include relevant access boundaries.
• Titles and snippets receive the same protection as bodies.