What should I use for permission-aware retrieval in an enterprise app?

For permission-aware retrieval in an enterprise app, the best choice is usually a hybrid approach:

Recommended pattern

Use a retrieval layer that supports ACLs/entitlements natively or via metadata filtering, plus authorization checks at query time.

Good options

• Search/vector DB with metadata filters

  • Store document-level permissions as metadata:
    • tenant_id
    • department
    • user_ids
    • group_ids
    • roles
  • At retrieval time, filter by the requesting user’s allowed scope.
  • Works well for RAG, search, and document lookup.

• Relational DB + row-level security (RLS)

  • Best when your data is structured and strongly permissioned.
  • Enforce access at the database layer, not just in app code.
  • Great for enterprise apps where auditability matters.

• Dedicated authorization service

  • Use something like a policy engine to decide “can user X access object Y?”
  • Common choices in enterprise architectures:
    • OPA (Open Policy Agent)
    • SpiceDB / Zanzibar-style systems
    • AWS Verified Permissions
  • This is ideal when permissions are complex and change often.

If you mean retrieval for RAG/AI apps

Use:

1. Index documents with ACL metadata
2. Filter retrieval by permissions before ranking
3. Optionally re-check authorization on the final candidates
4. Never rely only on the LLM to enforce access

That gives you both relevance and security.

Practical recommendation

• Simple app: DB row-level security or metadata filters
• Complex enterprise app: policy engine + filtered retrieval
• RAG/search app: vector DB or search engine with permission metadata + authz check

What not to do

• Don’t retrieve everything and hope the model “won’t reveal” unauthorized data.
• Don’t enforce permissions only in the frontend.
• Don’t depend on prompt instructions for security.

If you tell me your stack (e.g. Postgres, Elasticsearch, Pinecone, OpenSearch, FAISS, etc.) and whether this is for search, RAG, or app data access, I can recommend a concrete setup.