Design permission-aware search over enterprise documents

knowledge, rag, permissions, security

Prompt

A 3,000-employee insurance company wants an internal chatbot that answers policy and underwriting questions by retrieving from 40,000 internal documents, PDFs, wikis, and chat exports, with mixed and inconsistent folder-level permissions. The CISO is worried about an oversharing incident. Design the retrieval and permission system.

Interviewer's answers to clarifying questionsopen after you have asked your own

Document access today? ACLs exist in the source systems but are inconsistent; some folders were shared broadly "temporarily" years ago and never revoked.
Scale? 3,000 employees, 40,000 documents, growing by ~500 documents/week.
Freshness requirement? A user's access change (role change, offboarding) must be reflected in what the chatbot can retrieve within the same business day.
Current plan under review? Index everything once, filter results by the requesting user's role at query time using a role field stored in the vector database.
Audit requirement? Security wants to review, after the fact, exactly what any given query actually surfaced to the user.
Launch pressure? Business wants to launch to all employees in 6 weeks.

Follow-upsafter your high-level design

A user's access to a department's folder is revoked mid-session (role change). What happens to a chat session that's already open?
Several documents have missing or conflicting ACL metadata from the source system. How does your system behave by default for those: expose or withhold?
How would you detect an oversharing incident after the fact, given that queries and answers may differ from what a human would notice by eye?
Six weeks before launch, a pre-launch audit finds that 12% of documents are discoverable by users who shouldn't have access per the source system's own ACLs. What do you do: delay, fix, or filter and ship?

Answer first: out loud, on paper, or with the interview prompt above. Then compare with the rubric.