In a document search system, access rights must be applied at search time: a user must only retrieve the passages they have the right to read. Filtering after generation is too late, because the forbidden content would already have been seen by the model.
Example
SELECT id FROM chunks WHERE group_id = ANY($groups) ORDER BY embedding <=> $1 LIMIT 5;