A common pattern in early AI system design is to retrieve broadly, then filter what the user is allowed to see before showing the answer. It feels reasonable, and it is a serious access-control failure waiting to happen, because filtering after the fact only prevents the answer from being displayed — it does not prevent the model from having already reasoned over content the user should never have accessed.
The model already saw what you filtered out
If a retrieval step pulls twenty passages, including some the requesting user is not permitted to see, and a filtering step removes the disallowed ones before the final answer is shown, the model has still processed those passages to generate context. In some architectures, summaries or intermediate reasoning derived from them can leak through — in the final answer's phrasing, in a follow-up question, or in a debugging log nobody thought to restrict.
In practice. Access control belongs in the retrieval query, not in a post-processing filter. If a passage should not be visible to this user, it should never be fetched for this request in the first place.
Permissions have to be modelled at the same granularity as the data
Document-level access control is straightforward and frequently insufficient — a single document can legitimately contain sections with different sensitivity, and a permission model that only understands "can this user see this document" cannot express that. Systems that need this precision require permission metadata at the chunk or section level, applied at query time, not layered on afterward as a display-time filter.
- Model permissions as part of the retrieval index, not as a separate lookup the application remembers to call.
- Treat "no accessible content found" as a valid, expected retrieval outcome, not an error state.
- Audit what was retrieved, not just what was shown — the gap between the two is exactly where problems hide.
This is a solved problem in traditional systems — do not unsolve it
Role-based and attribute-based access control are mature, well-understood disciplines. Introducing an AI layer is not a reason to reinvent access control from scratch; it is a reason to make sure the existing access model extends cleanly into retrieval. The organisations that get this right treat the AI component as another consumer of an existing permission system, not as a new system with its own rules.
References
Access-control architecture notes from AFC's AI engineering practice are available on request.