Enforcing per-user permissions inside retrieval, tenant isolation in a shared index, and why post-filtering a result set is the wrong place to start.
3 questions in RAG, Retrieval & Agents.
Revoke once in the authorisation store, then propagate to the index ACLs, every cache holding text or results, any derived summaries and embeddings, and the conversation transcripts still carrying passages. Answers already delivered cannot be recalled, so the guarantee you offer is a bounded window rather than erasure.
Carry the authorised principal set on every chunk and pass the user's principals into the search as a filter, so the candidate set is legal before ranking. Filtering after retrieval leaks through counts and gaps, and destroys recall for the users with the narrowest access.
Choose between an index per tenant, per-tenant namespaces and one filtered index by weighing recall, blast radius and per-tenant fixed cost. Partitioning turns tenant selectivity from a search-quality problem into a routing decision, which is the argument most candidates miss.