Authorization applied after retrieval is too late if sensitive context already entered the prompt.
RAG ARCHITECTUREENTERPRISE AI ARCHITECTURE
Metadata Filtering and Authorization
Metadata filters constrain retrieval by tenant, classification, region, document type or user permission.
The retriever applies user-entitlement filters before vector search results are returned.
Where exactly is authorization enforced in the retrieval path?
REMEMBERAuthorize before context reaches the model.
No uploads · No company data · No account required