Atlas

Services

The decision worth arguing about

Access control lists are never copied into OpenSearch. The obvious design indexes each page with the groups allowed to read it and lets the search engine filter, and it is faster and simpler and has one flaw that matters: reindexing is asynchronous, so between a permission change and the reindex completing there is a window — typically seconds, occasionally minutes under load — in which a revoked user still gets hits. For a support knowledge base that is a nuisance; for a space containing redundancy plans or an acquisition, it is the incident. Atlas instead treats OpenSearch as a candidate generator: it returns document identifiers ranked by relevance, and Postgres applies Row Level Security and returns only what the current user may actually read, using permissions that are correct the instant they are committed. The trade-off is that the search engine's result count and pagination become untrustworthy, because post-filtering shrinks every page by an unknown amount. We over-fetch by a factor of three and paginate in the application, which is invisible for ordinary users and degrades measurably for someone whose access is unusually narrow — a contractor with two spaces out of four hundred can force several round trips to fill a page of ten results. We cap that at three fetches and show fewer results rather than spin, and we would rather show a short page than a leaked title.

Services

The decision worth arguing about

Azure AI Search has native document-level security trimming against Entra groups, which removes exactly the problem the AWS design works around — you can filter inside the index, on group membership the search service resolves itself, and there is no over-fetch. We use it, and the honest catch is one most teams meet in production rather than in design. Entra ID only emits group membership directly in the token up to roughly 200 groups; past that the token carries an overage claim pointing at Microsoft Graph, and resolving it means a Graph call on the request path. In a 1,500-person company with a group per team, per project and per region, plenty of people are past that limit, so Atlas resolves transitive group membership through Graph once per session and caches it in Redis for fifteen minutes. That cache is the trade-off, and it reintroduces a smaller version of the staleness the AWS design was avoiding: a permission revoked at 10:00 can survive in one user's cached membership until 10:15. We accept that for group changes and force an immediate cache eviction on explicit page- and space-level permission changes, which are the ones people make when something has actually gone wrong.