Securing Private-Corpus Queries: ACLs, Deletion Propagation, and Freshness
Authorization must take effect before candidate generation, while ACLs, deletion events, and source versions must propagate to every derived index; freshness needs measurable event-time SLOs too.