Test retrieval access filters before model context assembly

Test permission-aware retrieval by inspecting the final context sent to the model, not just the documents displayed in the interface. An unauthorized passage can influence an answer even if its citation is hidden afterward.

Use relevance to challenge the boundary

Create a private document for tenant B containing the strongest semantic match to tenant A’s question, plus a permitted document with a weaker match. Authenticate as A and inspect retrieval, context assembly, logs, and final output. The expected result excludes B’s private text at every unauthorized exposure point.

Place the filter where it can enforce access

1. Derive the user and project scope from trusted authenticated context.
2. Apply the data store’s supported authorization or filtering mechanism before exposing private candidates.
3. Recheck relevant permissions when assembling context if earlier metadata may be stale or incomplete.
4. Test direct source links, debug views, reranking calls, and fallback retrieval paths as well as the final answer.

Check the actual outgoing context

The fixture contains a distinctive private marker. It shows that a context built from all retrieved candidates leaks the marker, while an authorized selection omits it. This is a synthetic record check. It does not establish that a remote index prevents unauthorized candidates from being fetched or logged earlier in the pipeline.

Keep filtering and search quality separate

A filter can protect access while accidentally removing relevant permitted documents. Measure both permission isolation and retrieval coverage. A security boundary must not be relaxed to improve recall; fix metadata or indexing when the authorized evidence is missing.

Run the worked example

Save the synthetic Node.js example and run node test-retrieval-access-before-context.mjs with Node.js 22 or newer. The assertions check the illustrated records and calculations; they do not test a deployed provider, SDK, or access control. No credentials or network connection are needed.

// Synthetic teaching fixture. No credentials, network calls, or production verification.
import assert from 'node:assert/strict';

const actor = { tenant: 'a' };
const retrieved = [
  { tenant: 'b', text: 'PRIVATE_SYNTHETIC_MARKER' },
  { tenant: 'a', text: 'Permitted policy text' },
];
const unsafeContext = retrieved.map(x => x.text).join(' | ');
const context = retrieved.filter(x => x.tenant === actor.tenant).map(x => x.text).join(' | ');
assert.equal(unsafeContext.includes('PRIVATE_SYNTHETIC_MARKER'), true);
assert.equal(context.includes('PRIVATE_SYNTHETIC_MARKER'), false);
assert.equal(context, 'Permitted policy text');
console.log('Private synthetic passage is absent from the authorized context.');

References and further reading

• OWASP: authorization checks and testing
• DriftRail integration documentation

Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.