Hard · 14 steps · ~55 min

Design enterprise search with permissions

Employees search and ask across documents, tickets and chat, each source with its own access rules. Filter by permission before the model, then size indexes, cache and models within a budget.

Employees search and ask questions across the company's content: documents, tickets and chat. The content lives in many source systems, each with its own idea of who may see what. Connectors pull content and permission changes through a queue and workers into a keyword index and a vector index, and every chunk is tagged with the people and groups that may read it. At question time the system works out who is asking, filters by their permissions inside the indexes (before anything reaches the model), reranks the survivors and answers with citations. You must size connectors and workers, both indexes, the reranker, a cache that stays safe across permission scopes, and the model path, within a budget. You must also survive the loss of a search node, a cold cache and a provider outage.

Same problem as Workplace search assistantsKnowledge-base chat

How it works

• Sync: connectors read changes (edits, deletes and permission changes) incrementally and put them on a queue.
• Index: workers split content into chunks, embed them, and write each chunk with its allowed principals to the keyword and vector indexes.
• Retrieve: the asker's principals are applied as a filter inside both index queries; the reranker keeps the best few.
• Answer: the model sees only permitted passages and cites them; a cache keyed by permission scope saves repeat work.

What you'll build

1. The API and the connector, document, chunk and membership data
2. The question path and the ingestion path with fan-out to two indexes
3. A permission-scoped cache, and a budget
4. A lost search node, a provider outage, a cold cache, and the full peak
5. Deep dives: filtering in the index, connectors and deletes, revocation lag, cache leaks, shared semantic caches

Steps

1. 1Design the search, answer and connector API
2. 2Design the connector, document, chunk and membership data
3. 3Answer 300 questions a second across all sources
4. 4Deep dive: where to enforce permissions
5. 5Ingest from many sources through a queue
6. 6Deep dive: connectors, incremental sync and deletes
7. 7Deep dive: permission sync lag and revocation
8. 81,500 questions a second with a permission-scoped cache
9. 9Deep dive: caching without leaking across users
10. 10Deep dive: why one shared semantic cache is dangerous here
11. 11Peak morning: lose a search node
12. 12The model provider has an outage
13. 13Survive a cold cache
14. 14Put it together: 7,000 questions a second, provider down