c3.3 Enforce retrieval access control with metadata filtering

The retrieval layer is an access-control boundary

In a RAG application, the model answers using whatever the retriever pulls from the knowledge base. If retrieval returns a document the user should not see, the model will happily summarize it into the answer — a data leak with no obvious trace. So retrieval is not just a relevance problem; it is an authorization boundary. Metadata filtering is how you enforce it: attach attributes (department, classification, tenant, effective dates) to each vector, then filter every query by the requesting user's entitlements.

Attach metadata at ingestion

Each source document carries a metadata sidecar (e.g. document.pdf.metadata.json) with the attributes you will filter on:

{
  "metadataAttributes": {
    "department": "finance",
    "classification": "confidential",
    "tenant_id": "acme-123"
  }
}

These become filterable fields on every vector derived from that document.

Filter every query by the caller's entitlements

On Retrieve / RetrieveAndGenerate, pass a retrievalConfiguration whose filter is built from the authenticated user's attributes — never from user-supplied input. Combine conditions with andAll so all must hold:

{
  "retrievalConfiguration": {
    "vectorSearchConfiguration": {
      "filter": {
        "andAll": [
          { "equals": { "key": "tenant_id",     "value": "acme-123" } },
          { "equals": { "key": "department",     "value": "finance" } },
          { "notEquals": { "key": "classification", "value": "restricted" } }
        ]
      }
    }
  }
}

Bedrock supports operators such as equals, notEquals, in, greaterThanOrEquals, and the boolean combinators andAll / orAll.

Build the filter server-side from a trusted identity

The security of this control rests entirely on where the filter values come from. Resolve tenant_id, department, and clearance from the caller's verified identity (the JWT claims / session), in your backend — never let the client send the filter. If a user could set their own tenant_id, the boundary is gone.

Naming note: keep metadata keys consistent across all documents; a typo (dept vs department) silently excludes or leaks documents. Validate the metadata schema at ingestion.