How do you implement permission-aware (ACL-aware) retrieval correctly?

30-second answerSay your answer out loud first, then reveal.

Store each chunk's access-control list (allowed users and groups, or a reference to the document's ACL) alongside the vector. At query time, resolve the authenticated user's identity and group memberships and apply them as a filter inside the retrieval engine, before results are returned. Keep ACLs in sync with the source systems, including group membership changes and revocations, and test for leakage. Never let the LLM decide what a user may see.

The user's SSO token is resolved to identity and groups, which become a filter (chunk ACL intersects user principals) applied inside hybrid search together with the query, so only permitted chunks reach the LLM; source ACL changes are synced into the index's ACL fields.

Approaches

Approach	How	Pros	Cons
Pre-filter in engine (recommended)	ACL fields on chunks; engine filters during search	Secure, correct k	Needs filtered-ANN support; ACL fields must stay synced
Post-filter	Retrieve top-N, then check permissions per result	Simple; real-time permission check against source	May return fewer than k; wasteful; risk of leaks if buggy
Index per tenant / per group	Separate indexes	Strong isolation	Explodes with many groups; good for tenant-level isolation
Hybrid	Pre-filter by coarse ACL, then a real-time check for sensitive docs	Defence in depth	More complexity

Hard parts

Group explosion and nesting: users belong to hundreds of nested groups. Flatten them at sync time, cache them per user, and handle large group lists in filters.
ACL change propagation: when someone loses access, results must stop showing within an SLA. Treat revocations as high priority.
Inheritance: folder-level permissions inherited by files, plus page-level restrictions (Confluence).
Derived data leakage: caches, summaries, and contextual enrichment generated from restricted docs must carry the same ACL. A semantic answer cache must be keyed by permission scope.
Testing: automated tests with synthetic users verifying that they cannot retrieve restricted content, including through paraphrased queries.

Interview line. "Security filtering happens before the model sees anything. The LLM is not an access-control layer."

PreviousDesign an enterprise knowledge assistant over Confluence, Google Drive, SharePoint and Slack for 10,000 employees.

You understood something today that you didn't yesterday.

How do you implement permission-aware (ACL-aware) retrieval correctly?

Approaches

Hard parts

Related