Context graphs & permission-aware retrieval
Grounding agents in enterprise knowledge without quietly dismantling a decade of access control.
Purpose limitation
Minimum necessary
Provenance of grounding
The problem
Retrieval is where most enterprise agent programmes break their own access model, and they do it invisibly. An index is built to make an agent useful; permissions live in the systems the documents came from; nothing carries them across. From then on the agent's reach is the union of everything ever indexed, and the access controls the organisation spent ten years building apply to a copy of the data nobody is checking. It does not present as a security incident. It presents as an unusually helpful assistant.
Where it breaks
| Failure point | What actually happens |
|---|---|
| Permissions lost at index time | Access rules live in the source system; the vector store holds text. Unless entitlement travels with the chunk and is evaluated at query time, the index is a permission-free copy of the estate. |
| Late filtering | Retrieving broadly and filtering the answer afterwards still put the content in the model's context. The information was disclosed; only the display was suppressed. |
| Inference across the join | Documents that are individually permitted can, joined, reveal something none of them carried alone. Row-level thinking does not catch it. |
| Purpose has no representation | DPDP and GDPR bind processing to a stated purpose. A graph that answers anything cannot express a purpose boundary, so the constraint has to be architectural rather than declared. |
| Stale entitlement | Somebody leaves a project; source access is revoked; the index keeps answering. Re-indexing cadence becomes an access-control decision nobody has framed as one. |
| Grounding without provenance | An answer a reviewer cannot trace back to the specific record it rested on is not evidence, however correct it happens to be. |
Standards and regimes named on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
What this actually consists of
- Entitlement-carrying retrieval: permissions evaluated at query time against the asking actor, not filtered afterwards
- Context-graph design over flat indexes, so relationships and their access implications are explicit rather than emergent
- Purpose boundaries expressed in the architecture rather than in a policy document
- Revocation and re-index cadence treated as an access control with an owner
- Provenance on every retrieved fact, so a grounded answer can be reconstructed to source
The test
Ask the system a question as one employee, then as another with narrower access, and compare. If both get the same answer, retrieval is not permission-aware — regardless of what the design document says.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.