Permission-aware RAG: enforcing document access at retrieval time

Many internal knowledge assistants rely on a system prompt telling the model to respect document permissions, but that is not real access control, since restricted content can still reach the model's context. The recommended fix is to store each chunk's access-control list as filterable metadata and apply the user's group filter inside the vector or hybrid search, rather than dropping results after retrieval. Permission changes also need to be treated as urgent events, using change notifications where available and short re-sync schedules otherwise, because stale ACLs act as a delayed data leak. The guidance extends to answer caches, conversation memory, and agent tools, which should act with the end user's delegated rights instead of a privileged service account. Finally, it recommends validating that every cited chunk was actually retrieved for that user and adding permission tests to the evaluation suite.