Access-Aware Retrieval

Mental model

Retrieval security is a query-time policy boundary: unauthorized candidates must not enter the model context, logs, cache, or explanations.

Learning outcomes

• Explain the mechanism and ownership boundaries behind Access-Aware Retrieval.
• Compare the main design alternatives and their operational trade-offs.
• Diagnose common failures and select evidence for a production decision.

Theory

Propagate identity and tenant context, filter at the earliest trustworthy layer, bind cache keys to policy context, recheck sensitive documents, and test negative access cases. Preserve source ACL versions for audit.

Trade-offs

Pre-filtering protects confidentiality but can reduce recall and complicate indexes. Post-filtering is easier to add but risks side channels and unauthorized processing.

Failure modes and misconceptions

Filtering after generation; global semantic caches; metadata copied out of sync; trusting client tenant IDs; leaking counts or titles; and testing only allowed access.

Decision scenario

Two customers use the same knowledge platform. Design retrieval and cache keys so semantically identical queries cannot cross tenant boundaries.

Primary sources

• nist-zero-trust
• pgvector-docs