Authorization must be enforced before and throughout retrieval and must propagate to embeddings, summaries, inferred edges, caches and action inputs.

Derived artifacts can reveal protected information even when raw nodes are hidden.

Retrieval poisoning and indirect instructions exploit content after ingestion.

The AI Act requires logging, transparency and human oversight for applicable high-risk systems.

Policy intersection can over-restrict harmless aggregate or anonymized products.

Fine-grained enforcement increases query latency and operational complexity.