The hard-versus-soft metadata distinction is especially important, but I would keep tenant, permission, and superseded-document gates outside any model-derived query filter. Soft constraints such as topic or freshness can degrade gracefully when extraction is uncertain; authorization and document status must fail closed under server-owned policy. Logging candidate counts before and after each hard gate also makes an empty retrieval result explainable instead of mysterious.