A retrieval system can authorize information before an AI model sees it. Typed Partial Evaluation (TPE) evaluates a Cedar policy when part of the authorization request is unspecified, returning a residual policy that describes the remaining conditions for access. section 17.4.3
TPE supports two related authorization patterns:
- For retrieval, it can leave resource details open, translate the residual policy into metadata constraints, and restrict vector-database results to authorized tenant, ownership, or classification scopes. section 17.4.3
- For agent planning, it can leave the action or resource open and return permitted actions or accessible resources before the agent builds a plan. section 18.4.1
- The resulting constraints guide planning but do not replace execution-time authorization; each action remains subject to policy evaluation. section 18.4.1
Planning with a partial request
An agent request can specify the principal, resource, and context while leaving the action unspecified. TPE can return permitted actions such as documents.search, documents.read, and documents.summarize, allowing the agent to plan within those policy-derived limits. section 18.4.1
Figure 17.4 Authorization before retrieval in RAG systems. Authorization constrains retrieval rather than generated output. By enforcing access before data is retrieved, the system ensures that the language model operates only on authorized inputs, making information leakage structurally impossible rather than merely discouraged.
Use the retrieval-flow diagram to see how authorization constrains inputs before retrieval, preventing unauthorized content from reaching the language model. section 17.4.3
Figure 18.3 Policy constraints guiding agent planning. During planning, the agent queries the policy system with a partial request. The policy engine returns constraints, such as permitted actions or accessible resources, that the agent incorporates into its plan. Each action is still evaluated at execution time to ensure consistent enforcement.
Use the planning diagram to trace how a partial authorization request produces constraints that guide an agent while execution-time checks preserve enforcement. section 18.4.1
