Retrieval ignores the requesting user's permissions

Filter every vector, search, and tool lookup by the requester's tenant and groups at query time, and re-check read access on each retrieved item before it enters the prompt.

In the retrieval function that builds the model's context, the authenticated requester's tenant_id and group ids go into the query itself (filter=, namespace=, or the search service's security-trimming parameters), taken from the server-side session and never from the request body or model output. Each returned item is then re-checked with can_read(user, doc) against current permissions and dropped if it fails. Documents are indexed with ACL metadata (tenant_id, allowed_groups) that a sync job updates when permissions change. A single-tenant index, or one holding only content every permitted user may read, removes the need for per-query filters.

Where it goes: 1 application source code, 6 API calls and integrations, 2 data models, 7 prompt construction.

What reviewers look for: every similarity_search, as_retriever, index.query, or search call over multi-user data carries a filter or namespace bound to the session user or tenant; a post-retrieval authorization check before the prompt is built; ACL fields stored with indexed chunks and a permission sync path.

docs = vectorstore.similarity_search(question, k=5)
context = '\n\n'.join(d.page_content for d in docs)

docs = vectorstore.similarity_search(
    question, k=5,
    filter={'tenant_id': user.tenant_id})   # from the session, not the request body
docs = [d for d in docs if can_read(user, d.metadata['doc_id'])]   # current ACL re-check
context = '\n\n'.join(d.page_content for d in docs)

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.