The strong rivalA shared index and post-filter can be adequate

For public or uniformly authorised corpora, a shared index with application-layer filtering is simple and proportionate. If candidate exposure has no additional consequence and every consumer may receive the same material, elaborate policy partitions create little value. A lightweight receipt that records the public source and version may be sufficient.

Sensitive enterprise retrieval changes the boundary. A post-filter lets protected candidates influence approximate search, rank order, prompt construction, caches, observability and timing. Unauthorised nearest neighbours can consume top results, causing the system to report no evidence even when permitted material exists. The absence becomes a recall defect created by access architecture.

Pre-filtering carries its own cost. Policy predicates can reduce approximate-search recall; per-tenant or per-policy partitions can multiply storage; group and relationship changes must propagate; stale replicas may deny legitimate work or allow revoked access. Treat these as measurable design choices. Compare access-aware retrieval, candidate expansion, physical separation and deterministic fallback on the actual corpus.

The boundary is consequence and uniformity, not fashion. Keep the public index simple. For confidential, personal, contractual or security-sensitive data, ensure protected content is excluded before it can influence a component the requester is not entitled to use.

Six permissionsKnowing a source exists is not using it

Discovery permits non-sensitive metadata about a collection. Retrieval permits content or structured facts to cross into the authorised processing path. Use permits the declared computation or decision. Disclosure permits a result, quote or explanation to reach a person or system. Retention permits storage beyond the immediate task. Action permits an external change. Each can differ for the same resource.

An internal control service may retrieve a clause, compare it with a transaction and return a masked pass or fail. The requesting user cannot see the clause. A support agent may retrieve customer correspondence for an assigned case but may not export it, add it to model training or retain it in general memory. An automated agent may propose an action while a human or separate service holds execution authority.

Combinations require their own decision. Two facts may be individually permitted but jointly reveal a protected health, employment or investigation inference. Apply policy to the derived result, relationship and destination. Minimisation can return a category, range, aggregate or yes/no finding when raw evidence is unnecessary.

Consent is not a universal authorisation field. Where it is relevant, preserve its purpose, scope, context, withdrawal and the power relationship in which it was obtained. Other contractual or lawful grounds may apply. Entitlement is the runtime enforcement decision; legal compliance remains a broader scoped assessment.

Original constructThe Retrieval Entitlement Envelope

The nine-dimension envelope is this article's synthesis. It is evaluated for one request and must survive into derived context and output.

Non-compensable gates: uncertain identity, uncontrolled delegation, incompatible purpose, stale policy or forbidden destination cannot be offset by high relevance.

RBAC, ABAC, ReBAC and purpose-based policy are complementary lenses. Roles provide stable job groupings and separation-of-duties constraints. Attributes describe subject, object, action and environment. Relationships express object-specific paths such as assigned investigator. Purpose connects access to the declared use. A production decision may combine all four without placing them on a maturity ladder.

Enforce before candidates existThe entitlement-before-evidence protocol

Type the request and resolve the acting principal, tenant, assurance and delegation. Bind purpose to a controlled task and decision rather than a free-form justification. Identify candidate partitions using metadata that is safe for the principal to inspect. Evaluate policy against resource, relationship, context, operation and destination before sensitive content is queried.

Construct search only over allowed partitions or use physical or cryptographic separation where required. For access-aware approximate search, pass enforceable predicates into candidate generation, expand candidates when filtering affects recall and provide a deterministic fallback. Retrieve and rank permitted evidence. An empty result means no permitted evidence was found under the tested route, not necessarily that no evidence exists.

Minimise inside the envelope. Remove fields, mask values, aggregate records or derive a bounded result according to the permitted operation and destination. Re-evaluate combinations that create a more sensitive inference than their inputs. Check generated output and tool requests against disclosure and action authority in deterministic application controls.

Issue an entitlement receipt and bind its expiry to caches, conversation state and durable memory. Revocation invalidates derived artefacts where policy requires it. The system should be able to find which chunks, summaries and outputs inherited a source decision without placing protected content into the receipt.

One decision, several policy lensesRoles alone cannot express the case

A case investigator role may permit access to investigation tools, while a relationship rule limits records to assigned cases. Attributes require a managed device, current clearance and acceptable risk. Purpose limits retrieval to investigating the named event. Delegation lets an agent search only during the task and prevents it from inheriting unrelated human rights.

Role hierarchy simplifies administration but can become broad. Attributes add context but require trustworthy sources and consistent evaluation. Relationship authorisation expresses fine object paths but needs current tuples and cycle or path rules. Purpose prevents secondary use but must be a controlled, enforceable value connected to workflow evidence. Combine the minimum lenses needed by the resource and consequence.

Separation of duties may prohibit one principal from both retrieving evidence and approving an action. A delegated agent can gather permitted facts yet cannot approve the case. Rich authorisation details can represent structured operations and resources more precisely than a coarse scope, but the resource server and policy engine still need shared interpretation and enforcement.

Policy should return obligations as well as allow or deny. A conditional decision may require masking, human review, notice, stronger logging, a particular destination, short expiry or deletion after the case. The enforcement point must prove that each obligation occurred before the protected operation completes.

Candidate influence mattersAccess-aware retrieval and safe absence

A shared embedding index can retain source text and access metadata after the source permission changes. Update pipelines must propagate ACL and policy versions with deletion and revocation. Until freshness can be proved, fail closed for sensitive partitions or refresh through an authoritative policy route. A model prompt cannot compensate for stale index control.

Post-filtering the top results can create false absence. Suppose restricted neighbours occupy every candidate slot while an allowed passage ranks just below them. Removing protected items returns nothing. Expand access-aware candidates, filter during search or query an authorised partition, then measure permitted recall. Do not interpret an empty post-filtered set as proof that the organisation lacks evidence.

Partitioning by tenant, classification or stable policy boundary can prevent cross-domain influence and simplify deletion. Excessive partitions increase storage, operational work and recall fragmentation. Attribute-aware indexes avoid some duplication but depend on policy-compatible query engines. Use physical separation when the consequence of candidate exposure requires it.

Denial semantics must not reveal title, count, identity, relationship or timing of protected material. Return a reason at the correct abstraction, such as no authorised evidence under the current purpose, identity or policy version. Provide step-up or review only when the caller is entitled to know that route exists. Timing, counts and cache behaviour also need testing for side channels.

Permission follows derivationChunks, edges, summaries, caches and answers

Source row or document controls do not automatically protect extracted chunks, embeddings, graph edges, summaries or generated answers. Every derived artefact needs provenance to its source policy and a rule for combined sensitivity. Store policy references and versioned labels where enforcement occurs, while retaining the authoritative decision at the source or policy service.

Chunking can separate a qualifier from restricted content and make an innocent-looking passage unsafe. Graph extraction can expose a hidden neighbour through an allowed node. A summary can reveal a combination not present in any single source. Evaluate the derived object and its destination, not only the parent document's label.

Caches must include identity, tenant, purpose, operation, destination and policy version in their reuse boundary. A response cached for one principal should not be replayed to another because the text appears generic. Revocation and source deletion must invalidate or recompute affected entries. Durable memory requires a separate retain decision and expiry.

Output enforcement checks quotations, identifiers, inferred attributes and actions. Prefer deterministic masking or policy-preserving transformation before model context where possible. After generation, validate the proposed result against the envelope and tool contract. The model may help transform allowed evidence; it is not the final policy decision point.

Conditional and emergency accessStep-up, break-glass and review

Require fresh delegation or identity step-up when assurance, sponsor, purpose, case assignment or policy state is insufficient but potentially resolvable. Step-up may require stronger authentication, sponsor confirmation, a current case, an approved purpose code or a managed device. Do not reveal protected content while requesting it.

Break-glass access is a narrow exception, not a permanent role. Require strong identity, named emergency, justification, minimum resource and operation, short expiry, notification and independent review. Record what was accessed and which obligation applied. Revoke automatically when the event closes and investigate repeated use.

A delegated agent receives task-specific authority. Its principal is distinct from the human sponsor; the chain records who authorised it, what resources and operations it may use, which destinations are permitted and when it expires. Sponsor revocation or task completion invalidates the agent's context and caches. Delegation cannot broaden rights through a prompt.

When policy freshness, source ACL propagation or destination control cannot be proved, redesign before retrieval. A manual approval after protected candidates have entered the model is too late. Temporary failure should have a safe response: use a current authoritative lookup, wait for synchronisation, return a minimised result or deny.

Decision evidence without protected payloadThe entitlement receipt

The receipt records policy and identity versions, allow, deny or conditional result, evaluated attributes and relationship types, permitted operations, transformations, excluded partitions without sensitive identifiers, downstream destinations, obligations, reviewer, expiry and revocation status. It never stores the raw evidence that was withheld.

For allowed retrieval, bind evidence identifiers and versions through controlled provenance. For masking or derived results, record the transformation and disclosure boundary. For denial, record a reason code at the safe abstraction. For step-up, record the missing assurance or delegation without confirming that a named protected resource exists.

Receipts support revocation and incident response. When a group membership is withdrawn or policy changes, identify caches, memory and downstream uses governed by the earlier decision. Invalidate, delete, recompute or review according to the obligation. A receipt that cannot drive action is only an audit artefact.

Retain receipts within their own purpose and access boundary. Policy evaluators and auditors may need details that requesters should not see. Aggregate operational measures can reveal stale-policy rates, recall loss or obligation failures without publishing protected resource counts.

Worked decisionOne investigation request, six separate control moments

Consider an internal investigator asking an assistant to determine whether a payment matches a restricted case pattern. The relevant evidence sits across an assigned-case store, a wider transaction archive, a sanctions source and a directory of employees. Some records may be discovered by case workers, some may be retrieved only by the control service, and some may be used solely to produce a pass, fail or needs-review result. The user requests an answer, not an indiscriminate search of everything the organisation holds. That difference gives the entitlement system a concrete job: translate the request into a bounded operation before any confidential candidate can shape retrieval.

1 · Resolve the acting principal and the delegated principal

The human signs in with a current managed-device session and has the investigator role. The assistant is a separate workload identity, not an invisible extension of that person. Its delegation names the human sponsor, the case, the permitted operations, the allowed control services, an expiry at task completion and a prohibition on export or durable memory. The runtime verifies those facts from identity and delegation services. It does not accept a prompt sentence such as “I am authorised” as evidence. If the sponsor’s session is weak, the case assignment is missing or the agent token names a broader tenant, the decision stops before source discovery and requests the appropriate identity or delegation step-up.

The delegated authority is intentionally narrower than the sponsor’s ordinary access. The human may open selected case documents in a reviewed interface, while the agent may only search approved fields and request a derived comparison. Conversely, the agent must not inherit personal mailbox access, unrelated investigations or the power to close the case. The sponsor cannot confer rights they do not possess, and delegation cannot remove separation-of-duties constraints. This prevents the common mistake of treating an agent as either the human in full or a generic service account shared by every user.

2 · Type purpose, resource, operation and destination

The interface converts the request into controlled values: purpose is investigation of case C; resource classes are assigned-case material, transaction facts and the approved sanctions source; operation is retrieve selected facts and derive a match result; destination is the internal case screen; retention is limited to the live task. Free-form wording remains useful context, but it cannot silently broaden those values. The policy service also knows the affected legal entity, jurisdiction, source owner and case state. A request to produce a customer-facing explanation would be a new disclosure operation with a new destination, even if it starts from the same evidence.

Discovery receives its own boundary. The resolver may reveal that an approved transaction source is available and current without revealing the existence, title or count of restricted investigations outside case C. Safe collection metadata is used to select candidate partitions. Protected document identifiers, graph neighbours and matching scores stay outside the caller’s observable path until authorisation has been evaluated. A denial therefore says that no evidence is available under the current entitlement, not that a named confidential record exists but is forbidden.

3 · Build the permitted evidence space before ranking

The policy result selects the assigned-case partition, permitted transaction fields and current public sanctions data. It excludes unrelated cases and employee records before the vector or lexical query runs. Within the allowed set, retrieval can use relevance normally. If an attribute-aware engine applies predicates during candidate generation, the team tests permitted recall against a deterministic lookup and expands the candidate pool where needed. If the search service supports only post-filtering, the design uses a physically separated index or a source query for this sensitive route rather than allowing restricted neighbours to occupy the ranking window.

This step changes how an empty result is interpreted. It means the tested authorised space produced no evidence at the recorded policy and source versions. It does not establish that the enterprise has no matching record, and it does not invite the model to guess. Operational evaluation therefore includes permitted recall, stale-policy denials, false absence, predicate latency and the proportion of requests that need deterministic fallback. Conventional search quality measured over the entire corpus is insufficient because it can reward results that the requester was never entitled to influence.

4 · Minimise the evidence and recheck the result

Suppose the control service may read a restricted sanctions attribute but the investigator may receive only the conclusion that enhanced review is required. The service retrieves the permitted attribute inside its own enforcement boundary, compares it with the transaction and returns a signed derived result. Raw values and the protected matching rule never enter the conversational model. The receipt records the source versions, derivation, destination and prohibition on quotation. The agent can explain the next authorised procedure without exposing the withheld evidence.

Combination sensitivity is evaluated at this point. A transaction range, employee location and unusual approval time might each be disclosable alone but identify a protected investigation when joined. The derived object therefore receives a classification and policy decision of its own. Masking one field is not enough if the remaining combination recreates it. The output checker tests identifiers, quotations, inferred attributes and requested actions against the permitted disclosure. If a useful result cannot be expressed inside that boundary, the route is denial or human review, not a creatively paraphrased leak.

5 · Bind caches, memory and tools to the same decision

The answer cache key includes tenant, principal class, case relationship, purpose, operation, destination and policy version, not just the question text. A result for case C cannot be reused for case D or another investigator. Conversation context carries the receipt identifier and expiry; durable memory is disabled unless a separate retention decision permits a deliberately minimised fact. Logs contain decision codes, latency and controlled provenance rather than prompt copies of protected evidence. Tool calls are checked again because authority to know that review is needed does not imply authority to freeze an account, notify a customer or file a regulatory report.

Now assume the investigator is removed from case C halfway through the conversation. The relationship service changes its version and emits revocation. The next turn cannot rely on the earlier allow: affected cache entries and live context become unusable, the delegated agent token expires, and derived artefacts are deleted or quarantined according to their obligations. The audit path can locate them through receipt and provenance links without searching their protected content. Revocation latency becomes a measurable service objective across the source, index, cache, memory and downstream tool boundaries.

6 · Treat emergency access as a different route

If an urgent incident genuinely requires evidence outside the normal assignment, break-glass does not mutate the investigator into a permanently privileged user. It creates a short decision with strong authentication, a named incident, minimum resource scope, declared operation, expiry, notification and independent review. Candidate generation remains limited to that emergency envelope. The requester sees only what the exceptional operation permits, and downstream disclosure or action still needs its own authority. Repeated emergency use, broad searches and failed review are control signals that trigger investigation rather than becoming evidence that the shortcut is normal.

The complete trace now contains six proofs: who acted and under whose delegation; which controlled purpose and case applied; which evidence space was eligible to influence ranking; which transformation and disclosure were permitted; which caches, memories and tools inherited the decision; and how expiry or revocation propagated. This is the practical meaning of entitlement before evidence. The system does not merely filter an answer at the end. It constrains what may become a candidate, what may become context, what may become an output and what may persist after the task.

Interactive instrumentRetrieval Entitlement Resolver

Set identity, purpose, resource, operation, destination and enforcement conditions. The Resolver returns one of five routes with the allowed operation, disclosure boundary, obligation and next control. It does not produce an access-risk score.

Exactly five outcomesWhat the entitlement decision permits

Allow scoped retrieval with an entitlement receipt

Use when principal, delegation, purpose, relationship, resource, context, operation and destination pass current policy. Retrieve only the authorised partitions, minimise and bind expiry or revocation.

Allow only a minimised, masked or derived result

Use when the computation is permitted but raw disclosure, quotation or a sensitive combination is not. Return a safe category, aggregate, range or pass or fail with transformation evidence.

Require fresh delegation, purpose or identity step-up

Use when access may be legitimate but assurance, sponsor, task scope, case state or emergency evidence needs renewal. Reveal no protected item while seeking the missing control.

Deny without revealing protected existence or content

Use for prohibited purpose, protected resource, invalid relationship or forbidden destination when the enforcement architecture is sound. Return only a safe reason and authorised review route.

Redesign the index, policy or source controls before retrieval

Use when sensitive post-filtering, stale ACLs, uncontrolled agent delegation, broken propagation or missing obligations permit protected influence. Stop retrieval until enforcement is upstream and revocable.

Resolver testsPublic, delegated, derived and emergency cases

Uniform public corpus: use a shared index, permit scoped retrieval and issue a lightweight receipt without policy partition theatre.

Assigned investigator: permit customer evidence only while case relationship, purpose, device and policy remain current.

Delegated agent: give the agent narrower retrieval than its sponsor and expire the chain with the task.

Discover but not retrieve: expose a safe collection description, withhold the restricted clause and record the disclosure boundary.

Retrieve but not disclose: run an internal control and return only a masked finding rather than the source passage.

Combination disclosure: individually permitted facts reveal a prohibited inference when joined. Permit only a safe derived result.

Restricted graph edge: block the protected relationship and hidden neighbour without changing the allowed starting node into a side channel.

Stale ACL: the source revoked access while embeddings and cache still carry the old group. Redesign freshness and fail closed.

Post-filter recall: protected neighbours consume the top results and hide allowed evidence. Move policy into candidate generation and test permitted recall.

Break glass: require stronger identity, named emergency, narrow operation, notification, independent review and automatic expiry.

Evidence boundaryAccess models, privacy duties and runtime synthesis

NIST Zero Trust Architecture supports resource-centred, least-privilege and continually evaluated access. NIST ABAC guidance describes subject, object, operation and environment attributes; RBAC research establishes roles, permissions, hierarchies and constraints. Relationship-access research and Zanzibar support path and tuple-based authorisation concepts. These are complementary implementation foundations.

XACML provides policy decision, enforcement, obligation and advice concepts. ODRL represents permissions, prohibitions, duties, parties, assets and actions. OAuth Rich Authorisation Requests provides structured fine-grained authorisation details beyond coarse scopes. Purpose-based research and Data Guard support treating purpose as an enforceable policy dimension. No one specification proves the complete retrieval envelope.

OWASP LLM02:2025 identifies sensitive-information exposure through generative applications and notes that prompt restrictions may be bypassed. OWASP LLM01:2025 covers direct and indirect prompt injection. Application controls, least privilege, upstream policy and output validation remain necessary. PROV-O supports receipt relationships without requiring protected payload.

GDPR and EU AI Act duties depend on the applicable processing, classification, role, provision, jurisdiction and timing. Authentication, authorisation, information flow, purpose, consent, entitlement, minimisation and legal compliance remain distinct. The Retrieval Entitlement Envelope, entitlement-before-evidence protocol, non-disclosure denial and Resolver are this article's synthesis.