Enterprise Generative Search — Azure and Open Source  ·  View 20 of 41  ·  Data

Permission Propagation

How authorisation travels from a source system to a filter, a cache key and an audit record.

Editable source SVG draw.io All views
At the source Native ACL item and folder Group membership Entra, nested Sensitivity label Purview At ingest ACL extraction with the content, not after Principal normalisation everything to an object id Deny capture deny beats allow Classification mapped label to ceiling In the index acl_allow[] object ids acl_deny[] evaluated first classification filterable tenant and region hard partition At query On-behalf-of token never a service identity Group set expanded transitive, cached 60 s Filter composed index-side, pre-scoring At render Citation re-check at display time Cache key fingerprint principal group set Audit record query, evidence, principal On change ACL delta job 60 second target Targeted re-index fields only, not content Cache invalidation by principal and document field-level update Permission Propagation — How Authorisation Travels With the Data Security / platform Application we own Decision point Data store event / async Post-filtering is banned. If the filter is applied after scoring, the ranked set already reveals what exists, and the top-k is quietly wrong. v 1.0 · owner Data and AI Global Practice

Decisions

  • Post-filtering is banned. A filter applied after scoring means the ranked set was computed over documents the caller cannot see, and the visible top-k is quietly wrong even when nothing leaks.
  • Deny is evaluated before allow, and both are stored on the chunk. Reconstructing a deny at query time from group membership is where this pattern usually fails.
  • The ACL fingerprint is part of every cache key. Without it, a cache turns an authorisation system into a leak with a hit rate.

Numbers

  • Entitlement change to effective in the index: 60 seconds P95, achieved with a field-level index update rather than a content re-index.
  • Group set expansion is cached for 60 seconds per principal; expansion latency 40 ms P95 warm, 260 ms cold.
  • Median group set size is 34 object ids; the filter is composed server-side and never accepted from a client.

Risks

  • A cross-principal cache hit is the highest-severity defect this platform can have. It is guarded by the fingerprint, by a nightly replay assertion, and by a contract test that fails if a cache key is constructed without one.
  • Sixty seconds is not zero. For the small number of sources where that window is unacceptable, retrieval is configured to verify entitlement against the source before the passage is shown.
◀  Evidence Data Model All views Freshness Lifecycle  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 41 views · Microsoft Azure and open source20-permission-propagation