Your senior staff answer the same 30 questions. Every single week.

# Permission is enforced at the database query level.
# The LLM never sees documents the user cannot access.
# (Simplified from AskBase's PermissionFilteredRetriever.)
async def retrieve(
    self,
    query_embedding: list[float],
    user_id: uuid.UUID,
    org_id: uuid.UUID,
    top_k: int = 10,
) -> list[RetrievedChunk]:
    query = text("""
        SELECT c.id AS chunk_id, c.document_id,
               d.title AS document_title, d.source_url, c.content,
               1 - (c.embedding <=> CAST(:embedding AS vector)) AS similarity
        FROM chunks c
        JOIN documents d ON c.document_id = d.id
        JOIN document_permissions dp ON d.id = dp.document_id
        JOIN user_groups ug ON dp.group_id = ug.group_id
        WHERE ug.user_id = :user_id
          AND c.org_id   = :org_id
          AND d.status   = 'indexed'
          AND 1 - (c.embedding <=> CAST(:embedding AS vector)) > :threshold
        ORDER BY c.embedding <=> CAST(:embedding AS vector)
        LIMIT :top_k
    """)
    result = await self.db.execute(query, {
        "embedding": to_vector(query_embedding),
        "user_id": str(user_id),
        "org_id": str(org_id),
        "threshold": 0.3,
        "top_k": top_k,
    })