A retrieval filter limits search results to resources that satisfy authorization constraints before content reaches the language model. In a multi-tenant system, it can restrict retrieval to chunks associated with the requesting user's tenant. section 17.4.3
Two authorization patterns can constrain retrieval:
- Translate a policy residual from Cedar typed partial evaluation into a query filter applied to chunk metadata such as tenant, ownership, or classification. section 17.4.3
- Retrieve a bounded candidate set with identifiers and relevance scores, authorize the candidates in one batch, and fetch only permitted resources. section 17.4.3
Figure 17.4 Authorization before retrieval in RAG systems. Authorization constrains retrieval rather than generated output. By enforcing access before data is retrieved, the system ensures that the language model operates only on authorized inputs, making information leakage structurally impossible rather than merely discouraged.
Shows authorization placed before retrieval, so the language model operates only on authorized inputs rather than relying on output-time safeguards. section 17.4.3
