A document-visibility search may need to find every resource a user could access without evaluating every policy against every candidate. Partial evaluation simplifies a policy with facts already known—such as the action, tenant, document classification, or labels—before runtime. The resulting policy residual or static predicate defines the scope of candidates that could satisfy the policy; the policy decision point (PDP) then confirms the remaining dynamic conditions, such as time, session risk, or device posture. section 13.5.3 section 17.4.3
The simplified constraint can be applied in several architectural layers:
- Convert principal and resource relationships into database joins, indexed field constraints, or graph traversals. section 13.5.3
- Prefilter candidate resources or principals, then use batch PDP evaluation to apply conditions that depend on runtime context. section 13.5.3
- Translate a policy residual into a retrieval filter over metadata such as tenant, ownership, or classification, keeping unauthorized content out of retrieval. section 17.4.3
Authorization before retrieval
A retrieval-augmented generation (RAG) service can use Cedar typed partial evaluation to turn authorization constraints into a vector-database filter. Retrieval then considers only chunks belonging to the authorized tenant or scope, rather than relying on the language model to avoid exposing restricted content. Alternatively, the service can batch-authorize a small set of search candidates before retrieving their content. section 17.4.3
# Example: docs this user can access
cands = graph.traverse_from_principal(p, action="doc:view")
scoped = prefilter_by_scope(cands, action="doc:view")
result = pdp.batch_authorize(principal=p, action="doc:view",
resources=scoped, context=ctx)
docs = [r for r, dec in result.items() if dec == "Permit"]
The flow shows graph traversal, scope prefiltering, batch PDP authorization, and final selection of permitted documents. section 13.5.3
Figure 17.4 Authorization before retrieval in RAG systems. Authorization constrains retrieval rather than generated output. By enforcing access before data is retrieved, the system ensures that the language model operates only on authorized inputs, making information leakage structurally impossible rather than merely discouraged.
The figure shows how authorization constrains RAG retrieval before authorized data reaches the language model. section 17.4.3
