Authorization happens before retrieval.
SecureCorp AI answers questions over enterprise documents and structured records — with hybrid search, cross-encoder reranking, and server-validated citations. Evidence is filtered by who’s asking, never after the fact. Unauthorized chunks reaching the model: 0.
>What is the remote work policy?
What actually happens to a query
Every request runs the same pipeline: authenticate, authorize, then route to hybrid document search, an authorized SQL path, or a safe refusal — before any evidence reaches the model. This is the real component the chat surface animates live.
Request pipeline — authorization before retrieval
idleAuthorization is enforced before retrieval, SQL, and generation.
Hybrid search, not just vectors
Dense retrieval alone misses exact identifiers — invoice numbers, policy codes, employee IDs. BM25 catches them. The two ranked lists fuse with Reciprocal Rank Fusion, then a cross-encoder reranks the bounded candidate set.
Hybrid pipeline
Exact identifiers, policy codes, acronyms
Semantic similarity over 384-dim vectors
Reciprocal Rank Fusion by unique chunk_id, k=60
Cross-encoder on the bounded candidate set
Why BM25 earns its place
Diagnostic probeProbing all 40 identifiers that occur in exactly one chunk — asking each retriever for the chunk containing it:
Diagnostic probe over 40 single-chunk identifiers — not the Phase 8 evaluation.
Authorization at the boundary
Roles and tenants are enforced in application code and the data-access layer — never inferred by the LLM. The client-supplied role is never trusted; the authenticated identity comes from a verified server-side token.
The invariant
0
unauthorized chunks reach the model context. Authorization is enforced at the data-access boundary — before retrieval, SQL, and generation — never by trusting the LLM.
§5 · Architecture invariants
Role-based access
Six application roles, plus attribute rules (ownership, manager scope) layered on top. A document’s allowed_roles and classification travel with every chunk.
Tenant isolation
EnforcedEvery row and chunk carries a tenant_id; the structured query path filters on it at the boundary. A query for another tenant’s record resolves to not found, not a leak.
Answers you can trace back
Citations are validated server-side and resolve to real indexed chunks or structured records. Structured questions take the SQL route; document questions take hybrid retrieval. Both return evidence you can open.
Citations resolve to evidence
The model may cite only evidence IDs the application supplied. Every returned citation is validated server-side and must resolve to an indexed chunk — unknown IDs are rejected. If evidence is insufficient, the system abstains instead of fabricating.
>What is the total of invoice INV-2026-0108?
Sign in and ask it something.
Six pre-seeded demo accounts, one per role. Watch the request pipeline animate live as your question is authorized, routed, retrieved, and cited.
Or sign in instantly as a demo user
Loading demo accounts…