# Freshness & access control

> Freshness and access control ask whether a source is current, and whether this user is allowed to see it.

Whether a source is current, and whether this user is allowed to see it.

Track: Retrieval & Grounding
Access: free
Card: https://buildsparkai.com/freshness-access
Plain text: https://buildsparkai.com/freshness-access.md
Last checked: 2026-10-18

## What it is

Two checks sit in front of the prompt. Freshness is whether the index still matches the file you would ship. Azure AI Search's indexer guide says a run processes what changed since an internal high-water mark, and that a run does nothing when the source is unchanged. The troubleshooting guide says a document you update after the indexer ran is missing until the next run. Access is whether this caller may see the hit. Azure's security filter guide says the filter compares a string on the query. There is no authentication through that string. The document-level access overview says security filters are generally available, and that POSIX-style ACLs, Purview labels, and SharePoint ACLs are preview. OpenAI's retrieval guide says you can set expires_after on a vector store, anchored to last_active_at . The example on that page uses 7 days. When the store expires, the files are deleted and storage for them stops. The picture shows a current policy, a stale line, and another group's doc. It does not run an indexer.

## Why it matters

**Cost.** OpenAI's retrieval guide lists storage beyond 1 GB at $0.10 per GB per day, vendor-reported, and points at an expiration policy as a way to stop paying for a store you no longer use. An Azure indexer run that finds no changes does not reprocess the corpus. This card does not add a price for a run.

**Quality.** A refund answer from last year's file is fluent and wrong. Azure's troubleshooting guide says the index lags until the indexer runs again. A high-water mark set in the future can skip rows that are older than that mark.

**Risk.** If the query omits the security filter, Azure's pattern does not add it for you. The guide also says setting the group field to not retrievable is not field-level security. The preview ACL paths are marked preview, and Microsoft says preview is not recommended for production.

## Try today

Pick one policy you would still ship. Write its date. If the index can show an older copy, name the job that refreshes it. Then name the filter that must be on every query for this user.

## Common mistake

Trimming results in the page after a wide retrieval, or trusting a group id the browser sent. Azure's guide says the application passes the caller's identity into the filter.

## Self-check

The index holds a 14-day refund for this user's group and a 30-day refund from last year. The query has no group filter. What can come back?

Both, including the stale policy

## Practice and deep

Coming soon. On the support-docs answer bot, name one sample doc a billing caller should not see, and the date you would stop shipping the refund sentence.

Coming soon. How an Azure indexer skips unchanged rows, and how a security filter trims by a string you pass on the query.

## Sources

- [Azure AI Search, Run or reset indexers](https://learn.microsoft.com/en-us/azure/search/search-howto-run-reset-indexers)
- [Azure AI Search, Indexer troubleshooting](https://learn.microsoft.com/en-us/azure/search/search-indexer-troubleshooting)
- [Azure AI Search, Security filters](https://learn.microsoft.com/en-us/azure/search/search-security-trimming-for-azure-search)
- [Azure AI Search, Document-level access](https://learn.microsoft.com/en-us/azure/search/search-document-level-access-overview)
- [OpenAI, Retrieval](https://developers.openai.com/api/docs/guides/retrieval)

Opened 2026-10-18. The $0.10 per GB per day storage line is vendor-reported. Security filters are the generally available pattern on the access overview. The ACL, Purview, and SharePoint paths on that page are marked preview. This card does not add a usage count.