Enterprise AI has a permission problem. Point a RAG assistant at a document repository and it will happily quote a contract the user was never allowed to open. The usual fix is to ship everything to a hyperscaler and trust an application-layer filter. For a hospital, a ministry or a court, neither half of that is acceptable.

Fifteen years of open source search inside a large content platform, and where it landed: a stack that runs on your own infrastructure, where the search engine itself decides who may read what.

Three eras, three permission models. Alfresco started on a patched Apache Solr fork with custom Lucene scorer classes and a separate ACL document type joined by hand at query time, so every Solr upgrade meant editing search-engine code. Moving to Elasticsearch and then OpenSearch replaced all of it with a standard client and a denormalised reader/denied filter. Today OpenSearch Document-Level Security pushes enforcement below the application entirely: one role, a terms lookup query, and no query the application can write will leak a document.

We then apply that to working retrieval-augmented generation over existing repositories. Live demo: two users, one question, two different answers, embeddings and language model running locally, nothing leaving the building.

You will leave with three patterns that transfer to any content source: enforce authorization in the storage layer, keep retrieval hybrid rather than vector-only, and make ingestion idempotent so batch and live sync can run together.