Start with the reader’s permission
Imagine an assistant searching documents for two customer projects. An employee can open one project’s files but has no access to the other. A useful answer must respect that boundary even when the restricted document is the closest match. Our suggested design starts with an access decision for each retrieval request, before any selected text enters the model’s context.
Connect identity to the search request
Microsoft documents an Azure AI Search pattern that filters results using stored user or group identifiers. It explicitly distinguishes this string comparison from authentication. Our recommendation is to derive the permitted scope from a trusted, authenticated application session and enforce it on every retrieval path. A project name typed into a question should never establish the caller’s access rights. Microsoft: Security filters for trimming results in Azure AI Search.
Review the permissions people actually receive
Elastic documents that document restrictions from multiple roles combine with OR: a match from one role can grant access. An unrestricted role on the same index can therefore remove the intended document restriction. For a pilot, review realistic combinations of roles, including temporary assignments. Test the effective access of ordinary users rather than relying on a demonstration conducted with an administrator account. Elastic: Controlling access at the document and field level.
Plan for permissions to change
Our proposed operating plan gives permission updates an owner and a defined propagation process. Track how access metadata reaches document fragments, search indexes and saved answers. Specify how cached results are scoped and invalidated when access changes. If the application cannot establish the permitted scope, stop retrieval and explain the access problem without revealing restricted titles or excerpts.
Test both useful answers and denied access
Use synthetic documents with recognisable test markers. Ask the same question as users with different permissions, then inspect retrieved excerpts, model context, citations and saved responses. Repeat after removing a user from a project and after changing their role combination. Record both the allowed task’s completion and the denied material’s absence. Make these checks part of acceptance and repeat them when connectors, indexes or identity rules change.