Vector Store ACL

The foundational mechanism for vector store ACLs. Permissions are encoded as key-value pairs in the metadata of each vector chunk.

• Pre-Query Injection: The retrieval engine appends a filter clause (e.g., user_group: 'finance') to the similarity search.
• Index Partitioning: Metadata filters create logical partitions within a single vector index, avoiding the overhead of managing separate indexes per security role.
• Performance Impact: High-cardinality metadata fields can degrade query latency if not properly indexed by the vector database engine.

ACLs can be applied at varying depths of the retrieval pipeline to balance security with recall.

• Document-Level: The entire source document is either fully accessible or fully restricted. Simplest to implement but prone to over-blocking.
• Chunk-Level: Individual text segments inherit permissions from their parent document or are assigned unique labels. This is the native granularity of vector stores.
• Field-Level: Specific attributes within a chunk's metadata or payload are redacted post-retrieval, allowing partial access to a chunk.

The secure handoff of the end-user's identity context from the application layer to the vector database.

• JWT Passthrough: The user's JSON Web Token is forwarded to the retrieval service, which extracts claims to build the metadata filter.
• Trusted Header: In a zero-trust mesh, a sidecar proxy injects verified user attributes into the request header before it reaches the vector store.
• Impersonation Risks: A broken propagation chain causes the system to apply service account privileges instead of the end-user's, leading to catastrophic data leakage.

Two distinct architectural patterns for enforcing ACLs during semantic search.

• Pre-Filtering: The metadata filter is applied before the ANN search. Guarantees no unauthorized vectors are considered but can severely limit recall if the filter eliminates relevant neighbors.
• Post-Filtering: The ANN search retrieves a larger candidate set, and ACLs are applied after similarity scoring. Improves recall but risks exposing vector IDs and distances to unauthorized logic.
• Hybrid Approach: Combines both by using a loose pre-filter for broad scoping and a strict post-filter for final enforcement.

The process of keeping vector store permissions aligned with the source identity provider (IdP).

• Event-Driven Updates: A change in a user's group membership in Okta triggers a webhook to re-index affected vectors with updated metadata.
• Stale Permission Risk: If synchronization lags, a recently terminated employee may still retrieve sensitive embeddings until the next batch update cycle completes.
• Direct Federation: Advanced architectures query the IdP in real-time during retrieval, eliminating sync delays but introducing a hard dependency on IdP availability.

The immediate enforcement of access removal across all derived artifacts.

• Instant Invalidation: When a user's access is revoked, their session tokens are invalidated, and any cached query results are purged.
• Downstream Propagation: Revocation must cascade to any LLM-generated summaries or chat histories that contain retrieved text from now-restricted vectors.
• Audit Trail Integrity: The revocation event is logged immutably, linking the identity change to the specific vectors that were blocked from future retrieval.