Permissions belong in the assembly context

The New Stack · 1 month ago · 23

The article argues that access permissions for retrieval-augmented systems should be resolved during context assembly (before any documents are fetched), not applied afterward as a filter. For a 17-hour period after a user leaves a team, the system can still retrieve finance documents and there is no guarantee that later summarization will respect updated access. It recommends shifting toward identity-aware context composition and re-checking authorization at every step so permission changes propagate correctly across multiple systems.