Embedding Pipeline Service · View 21 of 22 · Assurance
The fail-closed branch
- Message 12 is the decision this view exists for: an unreachable permission authority withholds everything and says so, rather than returning what the index happens to hold.
- Suppression is checked before the ACL batch, so a document revoked four seconds ago is dropped even if the authority has not yet caught up.
- The audit record carries counts, not content: that results were withheld is auditable; what they were is not.
Two identities, two jobs
- Workload identity (SPIRE SVID) proves which service is calling and gates the tenant partition it may address.
- Subject identity is carried as a claim and resolved against the corpus authority. The platform never decides whether a person may read a document.
- Human operator identity is separate again, through Keycloak, and reaches no tenant content without a grant.
Cost of this design
- A per-query batch ACL check is a hot-path dependency on a system the platform does not own, and it sets the floor on retrieval p99.
- Post-filtering means candidate sets must be over-fetched. Where a user can read very little of a tenant's corpus, recall suffers — the open question on view 15.
