# AM-RP-001: permission boundary evaluation plan

Author: Anant Mishra. Prepared 30 October 2026. Plan version 0.1.0.

**Preparation only: zero application scenarios executed.** The twelve scenarios are proposed integration tests. Local file validation does not show that any assistant enforces permissions, passes a scenario, or is ready for production.

## Material released

- `permission-test-plan.json`: fictional principals, document access matrix, twelve scenarios, expected stage behaviour, and execution dependencies.
- `permission-evidence.template.json`: deliberately unfilled evidence record. No timestamps, traces, decisions, reviewer, or outcome are supplied.
- This guide: scope, reproduction of preparation validation, and the evidence a later application evaluation must retain.

The existing quality cases AM-RP-001-Q05 and Q06 are preserved. This plan develops their retrieval/revocation boundary rather than reporting their execution. Alpha/Beta tenants, users, documents, revisions, and markers are all invented. They represent no client policy or identity system.

## Validate preparation files

From the website repository root:

```sh
python3 scripts/check-research-preparation.py
```

This offline standard-library check validates file relationships, unique IDs, scenario coverage, synthetic labels, source references, and the unfilled evidence template. It prints SHA-256 hashes. It makes no network or model call and cannot determine whether a scenario passed.

## Intended application contract

Obtain the principal and tenant from a verified session. Carry the relevant membership, source, and permission revisions through retrieval. Apply tenant and access constraints during search and check current authorization before text reaches a reranker or generator. Recheck relevant authorization before delivering an answer. Under this proposed consistency rule, a relevant revision change abandons the affected response and prevents its cache write.

Cached answers retain the contributing source IDs and versions. Reuse requires current source access; a shared question string conveys no permission. Source citations/downloads are reauthorized when opened. A permission-service failure keeps the affected operation closed and reports that access could not be checked.

This is a proposed contract. Atomicity, update propagation, cache invalidation, error handling, and storage behaviour need an actual implementation and tests under controlled changes. Revocation can block future delivery; it cannot recall information someone already read or copied.

## Scenario coverage

1. Allowed Alpha staff handbook retrieval.
2. Denied staff access to the Alpha finance document.
3. Allowed Alpha finance access to its budget.
4. Denied cross-tenant access despite identical group names.
5. Missing verified identity.
6. Missing document permission metadata.
7. Revoked membership before a warm-cache lookup.
8. Revocation between context assembly and answer delivery.
9. Cached answer requested by a different principal.
10. Previously issued source link opened after revocation.
11. Authoritative authorization service unavailable.
12. Stale index ACL conflicting with the current source policy.

The initial matrix applies before each scenario's stated transition. For the mid-request case, text may legitimately enter context before revocation; the expected later delivery is abandoned. Denied cases must not leak restricted titles, markers, excerpts, scores, or source links through user-visible diagnostics.

## Evidence required for a later run

Execute each case against a named application revision and controlled identities. Freeze input hashes, capture policy/source versions and cache state, and record the actual time and point of each access transition. Preserve authorization decisions and source IDs at retrieval, reranking, generation, cache write, answer delivery, citation and download boundaries. Collect actual outputs and synthetic-marker observations with an accountable reviewer and limitations.

Keep raw traces in a restricted evidence store. A public report can expose permitted synthetic fixtures and redacted summaries without publishing credentials, identity tokens, private endpoints, real prompts, or client documents. Do not fill the template from expected results or use a model's final refusal as proof that restricted text never entered context.

## Primary-source review

- NIST SP 800-207 supplies the resource/subject trust principle: https://csrc.nist.gov/pubs/sp/800/207/final
- OWASP Authorization Cheat Sheet covers deny-default decisions and per-request checks: https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html
- OWASP RAG Security Cheat Sheet discusses retrieval permissions, tenant isolation, and pipeline failure behaviour: https://cheatsheetseries.owasp.org/cheatsheets/RAG_Security_Cheat_Sheet.html

Checked 30 October 2026. The fixture matrix, twelve cases, and consistency rule are proposed evaluation choices; the sources do not validate an implementation or endorse this plan. AI assistance was used to prepare this draft material. No empirical finding, peer review, publication identifier, or Scholar indexing is asserted.