Make your AI assistant answer only from what each person may see

Syed Muzakkir Hussain — Sun, 25 Oct 2026 01:49:39 +0000

An AI assistant answers from documents it finds by search, and that search ranks chunks by how similar they are to the question. It does not know who is asking. So whenever documents with different readers share one index, the closest match to a question can be something the person asking was never allowed to see, and the assistant quotes it back.

The same leak shows up wherever privacy matters:

SaaS apps: someone at one customer asks when their contract renews and gets another customer's contract terms.
Healthcare: a question from the front desk pulls in a patient's diagnosis that only the care team may read.
Banking: an analyst on one side of an information barrier gets a summary of a deal they are walled off from.
Inside a company: an engineer asks about pay and the assistant summarises HR's salary bands.
AI agents: an agent that searches with a shared service account can read everything, whoever it is working for.

OWASP lists this in its Top 10 for LLM applications as LLM08:2025 Vector and Embedding Weaknesses: context leaking between users or tenants that share one vector database. The first fix it lists is fine-grained access control with permission-aware vector and embedding stores.

What wardowl does

wardowl is an open-source Python library (MIT) that makes retrieval permission-aware, with the vector store and the permission system you already run. Every search runs as the person asking:

It filters inside the search. When your permission system can describe everything a user may read, wardowl turns that into a filter in the vector store's own query, so the results are the true top-k of what that user may read, not the top-k of everything with the forbidden ones removed afterwards.
It checks every hit again. Pre-filtered results are re-checked, so a backend bug that ignores the filter cannot leak, and each result reports how many such violations it caught.
It fails closed. If the permission service errors, times out or answers nonsense, the user gets an error, never unfiltered results.

For agents, wardowl's MCP server takes the user from the verified access token on every request, so the model never chooses whose permissions it searches with.

A few lines of Python

This is the first case above, two companies sharing one assistant. The other cases use the same code; what changes is where the permissions come from, such as care-team relationships in OpenFGA or SpiceDB, deal teams in your policy engine, or groups from your identity provider.

from wardowl import (
    Document, InMemoryBackend, MetadataACLAuthorizer,
    PermissionedRetriever, Subject,
)

backend = InMemoryBackend([
    Document("contoso-order-form",
             "Contoso contract renewal: June 30, at list price.",
             {"allowed_groups": ["contoso"]}),
    Document("northwind-msa",
             "Northwind contract renewal: March 1, 3 years, 18% off.",
             {"allowed_groups": ["northwind"]}),
    Document("pricing-policy",
             "Renewal pricing policy for every customer.",
             {"allowed_groups": ["*"]}),
])
retriever = PermissionedRetriever(backend, MetadataACLAuthorizer())

bob = Subject("bob", groups=["contoso"])
result = retriever.retrieve("contract renewal", bob, k=3)
print([hit.id for hit in result.hits])
# ['contoso-order-form', 'pricing-policy']

Northwind's agreement never reaches the prompt, however similar it is. In production you swap the in-memory store for yours and the metadata check for your permission system.

Works with what you have

Vector stores: pgvector, Qdrant, Milvus, MongoDB Atlas, Weaviate, Redis, LanceDB, FAISS, Vespa, Cassandra, Pinecone, Elasticsearch, OpenSearch and Chroma.
Permission systems: OpenFGA, SpiceDB, Open Policy Agent, Cerbos, Cedar, Casbin and Ory Keto, or access lists in metadata, or your own rules.
Frameworks and services: LangChain, LlamaIndex, Haystack, an MCP server for agents, and an HTTP service for any language.

Tested the way a company would use it

The acceptance suite runs one assistant shared by two companies, each with HR, finance, engineering, legal and board documents, and people in different roles, from an HR manager to a contractor. It runs on 14 stores and seven permission systems, against real servers, a real identity provider and real embedding models, and checks every outcome against an independent list of who may read what: 3,912 checks in all.

pip install wardowl

GitHub: https://github.com/muzakkirhussain011/wardowl
Docs: https://muzakkirhussain011.github.io/wardowl/

Questions and feedback are welcome in the comments or on GitHub.

DEV Community: Syed Muzakkir Hussain

Make your AI assistant answer only from what each person may see

What wardowl does

A few lines of Python

Works with what you have

Tested the way a company would use it