Metadata Filtering

01 · 最像答案的文件，却不该给你看01 · The best match you are not allowed to read

一份法务文件相关性 98 分，但你只有财务权限；检索系统应该先把它拿来排名，还是在排名前锁住？A legal document scores 98 for relevance, but you have finance-only access. Should retrieval rank it first—or lock it before ranking?

02勾选部门、日期与版本，先收缩候选池再算相关性，越权文档始终锁定Filter by Department, Date, and Version Before Relevance Scoring; Keep Unauthorized Documents Locked

过滤先于排序 · 权限不可覆盖filter before rank · permission stays binding

状态 AMetric A

—

状态 BMetric B

—

状态 CMetric C

—

所有概率、命中率、得分与输出均为固定种子的教学模拟，不代表真实模型。拖回主变量即可复核结论。All probabilities, hit rates, scores, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.

03把刚才的变化拆成 4 个零件Break the Change into Four Parts

Metadata Filtering

METADATA

业务元数据Business metadata

部门、日期、版本描述适用范围。Department, date, and version define applicability.

POOL

候选池Candidate pool

只有匹配元数据的文档进入下一阶段。Only metadata matches enter the next stage.

PERMISSION

权限门Permission gate

越权文档即使相关也保持锁定。Unauthorized documents remain locked even when relevant.

RELEVANCE

04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction

MECHANISM

rankable = metadata_match ∧ permission_allowed

三个勾选框只改变 metadata_match；文档 C 的 permission_allowed 永远为 false，因此它不会进入右侧排序。The three checkboxes change only metadata_match. Document C keeps permission_allowed = false and never enters ranking.

收缩范围Narrow scope部门 + 日期 + 版本department + date + version

执行授权Authorize越权保持锁定unauthorized stays locked

计算相关性Score relevance只排可用候选rank eligible candidates only

05清空所有过滤器，尝试让高相关越权文档进入排序Clear Every Filter and Try to Rank a Highly Relevant Unauthorized Document

主动制造失败Create a failure

边界实验Boundary experiment

元数据筛选放宽不等于权限放宽。文档 C 会回到审计池，但仍不能进入相关性排序或回答。Relaxing metadata does not relax authorization. Document C returns to the audit pool but remains excluded from ranking and answers.

尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction first.

✗ 相关性最高的文档应该优先返回。The most relevant document should always rank first.→ ✓ 先满足权限、时间和版本，再谈相关性。Permission, time, and version eligibility come before relevance.

✗ 取消部门过滤就等于获得跨部门权限。Clearing department filters grants cross-department access.→ ✓ 过滤范围与授权是两道独立门。Filtering and authorization are separate gates.

✗ 只在生成答案时检查权限即可。Permission checks can wait until answer generation.→ ✓ 越权内容不应先暴露给排序或模型上下文。Unauthorized content should not reach ranking or model context first.

06 · 一句话带走06 · One line to keep

元数据过滤先用部门、日期和版本缩小候选池，再只对获授权文档计算相关性；高相关分永远不能覆盖权限锁。Metadata filtering narrows candidates by department, date, and version, then scores only authorized documents. A high relevance score can never override the permission lock.

元数据过滤 · 先限定可用范围，再谈相关性Metadata Filtering · Establish Eligibility Before Ranking Relevance