Security

Both fresh and cached RAG answers pass a current authorization check before release.

Your RAG cache outlives the user's permissions

Retrieval filters cannot protect an answer that bypasses retrieval. A runnable Python fixture demonstrates the revoked-access cache failure and a conservative release gate.