Enforce document authorization before semantic retrieval

Post-filtering a semantic result is too late. A forbidden document may already have influenced a reranker, model context, trace or cache even if the final citation is removed. The safe contract is candidate eligibility first, ranking second.

Build the decision artifact

Resolve the caller’s effective principal and groups at request time. Apply source permissions, tenant boundary and document status in the retrieval query itself. Rank only the eligible set. Recheck authorization before fetching content when permissions can change between index and source, and fail closed when the policy service is unavailable.

The enterprise delivery lab makes this reasoning executable with synthetic data:

from enterprise_cases import document_authorization_case

result = document_authorization_case()
assert result["retrieved"] == ["d1", "d3"]
assert result["forbidden_scored"] is False
assert result["authorization_stage"] == "before semantic ranking"
assert "d2" not in result["retrieved"]

For the finance role, the fixture ranks d1 and d3 and never scores legal-only d2. The small list makes the ordering observable. A real test suite also needs group changes, revoked documents, deleted users, cached answers, direct identifier lookup and mixed-permission chunks.

Test the failure path

Metadata copied during indexing becomes stale. Treat it as an acceleration structure, not an eternal authorization truth. Record its source version, reconcile changes, propagate revocation and define the maximum tolerated delay. Do not log forbidden content while explaining a denial.

Save evidence that another reviewer can inspect:

• authorization sequence diagram
• eligible-candidate query or policy decision
• negative retrieval fixtures
• revocation-lag measurement and cache invalidation test

This exercise aligns with the enterprise delivery, secure integration, operations and leadership work in the FDE for Professionals course. The course link describes the pathway; this local draft and its synthetic verifier do not claim that a client deployment, security approval or production result occurred.

Practice task

Add a revoked finance document to the fixture. Decide which component learns the revocation, how quickly, and how cached answers are invalidated.

Continue learning

This article is part of the Enterprise AI delivery and architecture sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Design tenant isolation across retrieval, tools and caches.
• Continue with Integrate a legacy system through a typed adapter.

Reference: NIST SP 800-207: Zero Trust Architecture.