Policy-aware Vector Search: A Vision for Fine Grained Access Control in Vector Databases

Vector databases are increasingly essential for Retrieval-Augmented Generation (RAG) and AI pipelines, yet they lack robust, native support for Fine-Grained Access Control (FGAC). Unlike traditional relational databases, vector databases rely on Approximate Nearest Neighbor (ANN) search, which complicates access control because filtering must be performed without sacrificing search quality or system performance. This creates a fundamental tension between ensuring that only authorized data is retrieved and maintaining the low latency and high recall expected of modern AI systems.

The authors formalize the FGAC enforcement problem in vector databases by defining a 3-tuple policy model (Object Constraints, Subject Constraints, and Action). They evaluate four primary enforcement strategies:

• Pre-filtering: Applying access control lists before the ANN search.
• Post-filtering: Executing the search first and discarding unauthorized results.
• Iterative Post-filtering: Repeatedly expanding the search space until enough authorized results are found.
• Parallel Post-filtering: Running multiple concurrent ANN searches across different semantic regions to increase the likelihood of finding authorized vectors.

The authors propose an optimization framework where the system dynamically selects the best strategy based on the query, the specific policy, and a required recall threshold.

Experimental results using the arXiv dataset show that pre-filtering is highly effective for high-selectivity policies but can be inefficient for others. Naïve post-filtering is fast but often results in poor recall. The authors demonstrate that their proposed parallel post-filtering approach provides a superior balance for medium-selectivity workloads, achieving better recall than standard post-filtering while avoiding the high latency associated with iterative scanning.