Access-controlled RAG: Pipeline implementation and metadata
Enforces authorization before retrieval and aggregation across index, cache, count, and delete surfaces so RAG pipelines never rely on post-generation filtering alone to protect restricted knowledge.