Context graphs & permission-aware retrieval
Grounding agents in enterprise knowledge without quietly dismantling a decade of access control.
The problem
Retrieval is where most enterprise agent programs break their own access model, and they do it invisibly. An index is built to make an agent useful; permissions live in the systems the documents came from; nothing carries them across. From then on the agent's reach is the union of everything ever indexed, and the access controls the organization spent ten years building apply to a copy of the data nobody is checking. It does not present as a security incident. It presents as an unusually helpful assistant.
Where it breaks
Permissions lost at index time
Access rules live in the source system; the vector store holds text. Unless entitlement travels with the chunk and is evaluated at query time, the index is a permission-free copy of the estate.
Late filtering
Retrieving broadly and filtering the answer afterward still put the content in the model's context. The information was disclosed; only the display was suppressed.
Inference across the join
Documents that are individually permitted can, joined, reveal something none of them carried alone. Row-level thinking does not catch it.
Purpose has no representation
DPDP and GDPR bind processing to a stated purpose. A graph that answers anything cannot express a purpose boundary, so the constraint has to be architectural rather than declared.
Stale entitlement
Somebody leaves a project; source access is revoked; the index keeps answering. Re-indexing cadence becomes an access-control decision nobody has framed as one.
Grounding without provenance
An answer a reviewer cannot trace back to the specific record it rested on is not evidence, however correct it happens to be.
What this actually consists of
Entitlement-carrying retrieval: permissions evaluated at query time against the asking actor, not filtered afterward
Context-graph design over flat indexes, so relationships and their access implications are explicit rather than emergent
Purpose boundaries expressed in the architecture rather than in a policy document
Revocation and re-index cadence treated as an access control with an owner
Provenance on every retrieved fact, so a grounded answer can be reconstructed to source
The test
Ask the system a question as one employee, then as another with narrower access, and compare. If both get the same answer, retrieval is not permission-aware — regardless of what the design document says.
Standards and regimes named on this page are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.