Your senior staff answer the same 30 questions. Every single week.

# Permission is enforced at the database query level.
# The LLM never sees documents the user cannot access.
async def retrieve_chunks(
    query_embedding: list[float],
    user_id: str,
    org_id: str,
    top_k: int = 8,
) -> list[Chunk]:
    return await db.fetch_all("""
        SELECT c.id, c.text, c.document_id,
               d.title, d.source_url, d.modified_at, d.modified_by
        FROM chunks c
        JOIN documents d ON c.document_id = d.id
        JOIN document_permissions dp ON d.id = dp.document_id
        JOIN user_permissions up
          ON dp.permission_group_id = up.permission_group_id
        WHERE up.user_id     = :user_id
          AND d.org_id        = :org_id
          AND c.embedding <=> :query_vec < 0.35
        ORDER BY c.embedding <=> :query_vec
        LIMIT :top_k
    """, {
        "user_id": user_id,
        "org_id": org_id,
        "query_vec": query_embedding,
        "top_k": top_k,
    })