Design permission-aware retrieval so users never see content they cannot access in the source system.

Use a two-stage retrieval design: high-recall candidate generation followed by a more expensive reranker. Partition indexes, version embeddings, filter by permissions, monitor recall and drift, and keep a lexical fallback for exact terms.

Make interfaces and ownership explicit; add versioning, access control, monitoring, canary rollout, rollback, and a plan for delayed labels or human review.