Permission-aware RAG: enforce access at retrieval, not in the prompt

· Dev.to