Secure retrieval and GraphRAG

Secure retrieval treats authorization as part of relevance computation, not a filter added after ranking. Graph nodes and relations have no independent ACL: their evidence contributions remain tied to authorized Knowledge Assets.

Retrieval model

Canonical scope before ranking

Search first resolves candidate stable Knowledge Asset IDs through OpenFGA. Canonical SQL then checks organization, lifecycle, current-version pointer, source revision, ingestion and current ACLs, classification, and publication, model, and profile state before full-text, vector, or graph ranking.

This order prevents a denied chunk, neighbor, degree, edge weight, or hidden entity description from affecting visible results.

Graph evidence model

Canonical entities and relations do not hold merged authorization-free descriptions. Each description, keyword, confidence, source revision, chunk, Knowledge Asset, ACL coordinate, model, prompt, and extraction time remains on an immutable evidence contribution.

SECURE_MIX combines chunk, entity, and relation evidence under one internal retrieval plan. The strategy is not a public request option. Results keep their structured contributions until the final pure-Java renderer assigns references and applies one model-context budget across every selected Knowledge Space.

Projection boundaries

PostgreSQL owns canonical graph identities, contributions, publication heads, and entity/relation vectors. Apache AGE stores topology identifiers for bounded candidate traversal. OpenSearch and Neo4j are replaceable adapters under the same contribution-level authorization conformance suite.

Every adapter returns candidates, not authorization decisions. AGE candidates are edge-filtered by authorized Knowledge Asset and then rechecked relationally. A bounded relational breadth-first traversal supplies the same port when AGE is disabled.

Request authorization snapshot

After ranking, the application BatchChecks and re-reads the complete entity/relation/chunk closure. Organization, OpenFGA model, ACL snapshot, source revision, and projection generation must still match. If authorization changes during retrieval, the request retries without sending evidence to the model.

The verified closure becomes an immutable snapshot for that Assistant turn. Revocation applies to the next turn. An already-started turn may finish under its snapshot and remains bounded by the configured turn timeout.

Citations

Only evidence that fits the final prompt budget receives a citation number. The browser makes interactive only the markers declared by the server. Opening a citation runs a fresh canonical check, validates revision and blob integrity, and streams original bytes through an authenticated no-store route. Missing, changed, and denied citations are indistinguishable.

Failure behavior

• a missing model route, mismatched immutable profile, malformed extraction, or failed snapshot closes the request;
• GraphRAG never silently falls back to canonical hybrid retrieval;
• reranking defaults off and cannot start without a named adapter;
• a transient reranker failure may retain the already-authorized order while emitting sanitized telemetry;
• one failed Knowledge Space fails a multi-space request closed.