Exactly. I would turn those candidate counts into a retrieval audit record: query identity, policy version, collection snapshot, counts after tenant, status, and ACL gates, and the final document IDs. The content scorer can change over time, but the policy decision should remain reproducible. That separation also lets you distinguish “nothing relevant” from “relevant evidence existed, but this principal was not allowed to see it.”
Ahmet Özel
AI Engineer. Computer Vision, RAG and LLM agents.
The hard-versus-soft metadata distinction is especially important, but I would keep tenant, permission, and superseded-document gates outside any model-derived query filter. Soft constraints such as topic or freshness can degrade gracefully when extraction is uncertain; authorization and document status must fail closed under server-owned policy. Logging candidate counts before and after each hard gate also makes an empty retrieval result explainable instead of mysterious.