Permissions belong at retrieval, not at display

Access control in most applications is a display concern. You fetch what you need, then decide what this person is allowed to see, and hide the rest. It is a reasonable habit and it is load-bearing in a great deal of working software.

It fails completely in a retrieval-augmented system, and it fails in a way that is easy to ship without noticing. If the check happens when the answer is rendered, the restricted document has already been retrieved, already been placed in the model's context, and already influenced the text that came back. Redacting the citation at the end does not unread it.

What leaks is not the document. It is the answer — a fluent summary of a file the person asking could not open, arriving with no indication that anything was withheld.

The only version that holds is enforcing access at retrieval: the query runs against the subset of the corpus this person may read, and everything downstream sees a corpus that never contained anything else.

AskQuo is built this way, and the practical payoff is not only correctness. One assistant serves people with different access, because the answer is a function of who asked. Without retrieval-time permissions the alternative is a separate deployment per audience, each with its own index to keep in step — which is how a permissions problem becomes an operations problem.

Answers that cite the passage they came from are usually justified as a trust feature, and they are. They are also the thing that makes a permissions failure visible.

If every answer carries its sources, a reader who sees a citation to something they should not have access to can say so. If answers arrive as unsourced prose, the same failure produces a fluent paragraph and no signal at all. A system that cannot show its sources cannot be audited for what it read.

The boundary between what the retrieved sources support and what the model would like to add has to be enforced and visible. A knowledge assistant that fills a gap with something plausible is worse than one that says it does not know, because the plausible answer is indistinguishable from a real one until somebody acts on it.

Refusal is the same feature here as in generation: the system's willingness to return less is what makes what it does return worth anything.