BuildSpark AI: practical AI concepts for builders. New here? Start with Tokens.
Home · Retrieval & Grounding · 11 · Freshness & access control
Concept card · Retrieval & Grounding
Freshness and access control ask whether a source is current, and whether this user is allowed to see it.
Whether a source is current, and whether this user is allowed to see it.
Oct 18: First card. The picture keeps a current policy for one group, then drops the filter. Sources are Azure AI Search's indexer, security filter, and document-level access docs, plus OpenAI's retrieval guide.
Two checks sit in front of the prompt. Freshness is whether the index still matches the file you would ship. Azure AI Search's indexer guide says a run processes what changed since an internal high-water mark, and that a run does nothing when the source is unchanged. The troubleshooting guide says a document you update after the indexer ran is missing until the next run. Access is whether this caller may see the hit. Azure's security filter guide says the filter compares a string on the query. There is no authentication through that string. The document-level access overview says security filters are generally available, and that POSIX-style ACLs, Purview labels, and SharePoint ACLs are preview. OpenAI's retrieval guide says you can set expires_after on a vector store, anchored to last_active_at. The example on that page uses 7 days. When the store expires, the files are deleted and storage for them stops. The picture shows a current policy, a stale line, and another group's doc. It does not run an indexer.
OpenAI's retrieval guide lists storage beyond 1 GB at $0.10 per GB per day, vendor-reported, and points at an expiration policy as a way to stop paying for a store you no longer use. An Azure indexer run that finds no changes does not reprocess the corpus. This card does not add a price for a run.
A refund answer from last year's file is fluent and wrong. Azure's troubleshooting guide says the index lags until the indexer runs again. A high-water mark set in the future can skip rows that are older than that mark.
If the query omits the security filter, Azure's pattern does not add it for you. The guide also says setting the group field to not retrievable is not field-level security. The preview ACL paths are marked preview, and Microsoft says preview is not recommended for production.
Pick one policy you would still ship. Write its date. If the index can show an older copy, name the job that refreshes it. Then name the filter that must be on every query for this user.
Trimming results in the page after a wide retrieval, or trusting a group id the browser sent. Azure's guide says the application passes the caller's identity into the filter.
The index holds a 14-day refund for this user's group and a 30-day refund from last year. The query has no group filter. What can come back?
Support-docs answer bot uses this concept in one build. The set on this tab is still the note below.
Coming soon. On the support-docs answer bot, name one sample doc a billing caller should not see, and the date you would stop shipping the refund sentence.
Coming soon. How an Azure indexer skips unchanged rows, and how a security filter trims by a string you pass on the query.