Paper deep dive
Policy-aware Vector Search: A Vision for Fine Grained Access Control in Vector Databases
Lakshmi Sahithi Yalamarthi, Primal Pappachan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 97%
Last extracted: 6/21/2026, 4:37:29 AM
Summary
The paper proposes a vision for 'Policy-aware Vector Search' to address the lack of Fine-Grained Access Control (FGAC) in modern vector databases. It formalizes an FGAC policy model based on Attribute-Based Access Control (ABAC) involving object constraints (metadata-based), subject constraints (user attributes), and actions (allow/deny). The authors identify a fundamental tension between policy enforcement, search recall, and query latency. They compare four enforcement strategies—Pre-Filtering, Post-Filtering, Iterative Post-Filtering, and Parallel Post-Filtering—using the pgvector extension on an arXiv dataset. The research highlights that while pre-filtering offers higher recall, it can suffer from latency issues depending on policy selectivity, and proposes that future work should focus on unified cost models and enforcing vector-based object conditions.
Entities (7)
Relation Signals (5)
ABAC → formalizes → Fine-Grained Access Control (FGAC)
confidence 100% · In our work, FGAC policies are represented as a 3-tuple following the ABAC policy model
HNSW → isanindextypefor → Vector Database
confidence 100% · It may under-utilize the efficient ANN indexes such as Hierarchical Navigable Small World (Malkov and Yashunin, 2018).
Fine-Grained Access Control (FGAC) → isimplementedin → Vector Database
confidence 100% · Specifically, Fine-grained Access Control (FGAC) ... is not fully supported in modern vector databases.
pgvector → usedforevaluationof → Fine-Grained Access Control (FGAC)
confidence 100% · We evaluate four different approaches for FGAC policy-aware vector search on Pgvector
Parallel Post-Filtering → improves → Recall
confidence 90% · PPF achieved competitive recall for medium-selective workloads, outperforming naïve post-filtering.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vector databases are increasingly used in security sensitive contexts with Retrieval Augmented Generation and organizational AI pipelines; however, their security capabilities remain limited. Specifically, Fine-grained Access Control (FGAC) which is required to ensure that data access adheres to user-specific policies is not fully supported in modern vector databases. Unlike relational databases, vector databases combine structured and unstructured attributes to provide semantic, approximate query results, which complicates FGAC implementation. This creates an inherent tension between enforcing FGAC policies correctly, achieving high ANN search recall and maintaining low query latency. In this paper, we present a vision for Policy-aware Vector Search by formalizing the FGAC policy model in vector databases as well as the enforcement problem. We compare various enforcement strategies, present preliminary findings, and identify key open challenges for future research in policy-aware vector search.
Tags
Links
- Source: https://arxiv.org/abs/2606.19803v1
- Canonical: https://arxiv.org/abs/2606.19803v1
Trouble viewing inline? Open PDF directly →
Full Text
28,141 characters extracted from source content.
Expand or collapse full text
by-nc-nd Policy-aware Vector Search: A Vision for Fine Grained Access Control in Vector Databases Lakshmi Sahithi Yalamarthi yalam2@pdx.edu Portland State UniversityPortlandOregonUSA and Primal Pappachan primal@pdx.edu Portland State UniversityPortlandOregonUSA (2026) Abstract. Vector databases are increasingly used in security sensitive contexts with Retrieval Augmented Generation and organizational AI pipelines; however, their security capabilities remain limited. Specifically, Fine-grained Access Control (FGAC) which is required to ensure that data access adheres to user-specific policies is not fully supported in modern vector databases. Unlike relational databases, vector databases combine structured and unstructured attributes to provide semantic, approximate query results, which complicates FGAC implementation. This creates an inherent tension between enforcing FGAC policies correctly, achieving high ANN search recall and maintaining low query latency. In this paper, we present a vision for Policy-aware Vector Search by formalizing the FGAC policy model in vector databases as well as the enforcement problem. We compare various enforcement strategies, present preliminary findings, and identify key open challenges for future research in policy-aware vector search. Vector Databases, Access Control, Retrieval Augmented Generation †journalyear: 2026†copyright: c†conference: Workshop on Secure and Private Data Management; May 31-June 05, 2026; Bengaluru, India†booktitle: Workshop on Secure and Private Data Management (SeQureDB ’26), May 31-June 05, 2026, Bengaluru, India†doi: 10.1145/3807894.3810276†isbn: 979-8-4007-2219-6/2026/05†ccs: Security and privacy Information accountability and usage control 1. Introduction Vector databases have become a foundational component of modern AI workloads, supporting applications such as semantic search, recommendation systems, and retrieval-augmented generation (RAG). As these systems are increasingly used in security sensitive environments, enforcing fine-grained access control (FGAC) over vector data is critical. This concern is especially acute in RAG pipelines, where retrieved documents directly influence generated responses from a Large Language Models. Current vector databases provide little to no support for the specification and enforcement of Fine-Grained Access Control (FGAC) policies. Unlike traditional relational databases, where data is structured as rows and columns, vector databases store and query over high-dimensional embeddings using similarity search. As a result, traditional FGAC enforcement approaches developed for relational databases (Pappachan et al., 2020, 2022) do not directly translate to vector databases. Retrieving the relevant vectors from this space typically relies on approximate nearest neighbor (ANN) search across potentially millions of vectors. In addition to the embeddings, vector databases allow storing metadata attributes associated with each vector. These attributes enable filtering during query processing, typically implemented using pre-filtering or post-filtering strategies. Consequently, FGAC policies can be specified over these metadata attributes or directly over the vectors themselves. While existing metadata filtering strategies could be leveraged for FGAC enforcement, they are not well suited for this purpose. In particular, post-filtering approaches, which first execute the vector search and then remove vectors that do not satisfy FGAC policies, can be highly inefficient when policies are selective, as many retrieved vectors may ultimately be discarded. The final recall can also be severely impacted if retrieved vectors do not satisfy the FGAC policies. In contrast, pre-filtering is based on Access Control Lists (ACLs) before executing ANN search. So, it may under-utilize the efficient ANN indexes such as Hierarchical Navigable Small World (Malkov and Yashunin, 2018), which are designed to operate over the entire vector space. Prior works have explored partitioning the vector space and building independent indexes but this require additional space overhead of multiple indexes and maintenance of these indexes (Zhong et al., 2026). The absence of accurate cost and recall models in vector databases further complicates the choice between pre-filtering and post-filtering strategies. Recently emerging area of Hybrid strategies for filter-aware vector search holds promise for FGAC enforcement. These approaches typically necessitate index modifications (Patel et al., 2024; Cai et al., 2024), are limited to metadata-based policies, and exhibit poor efficiency when policies affect only a narrow subset of the dataset.(Lin et al., 2025) In this paper, we first discuss in detail a novel FGAC policy model for vector databases that supports specification of FGAC policies on metadata attributes. We then discuss in detail the main challenge of enforcing FGAC policies that contains metadata filters. We formally define the FGAC enforcement problem and identify the key considerations for supporting it in vector databases. We evaluate four different approaches for FGAC policy-aware vector search on Pgvector (PostgreSQL enabled with Vector Search) to illustrate the latency-recall tradeoffs on a large real dataset with synthetic policies. We discuss the additional challenges of FGAC management in vector databases such as storage, maintenance, and enforcing FGAC policies that are specified as vectors. By discussing the trade-off between policy enforcement and efficient ANN retrieval, our work move towards practical, secure vector search in multi-tenant AI systems, where both retrieval quality and strict access guarantees are required. 2. FGAC Policy Model for Vector DBs In this section, we first describe the data, query, policy models and then we discuss the key considerations for implementing FGAC in vector databases.Throughout the paper, we illustrate our approach using a dataset of research papers, where vectors are generated from paper titles and abstracts (1), and access-control policies are generated from other columns. Data model: Let D denote the database consisting of vector-metadata attribute pairs: =(v1,m1),(v2,m2),…,(vi,mi),…(vn,mn)D=\(v_1,m_1),(v_2,m_2),…,(v_i,m_i),…(v_n,m_n)\ where each vector vi∈ℝdv_i∈\ R^d denotes a vector embedding of d dimensions and mim_i = mi1,mi2,…,mis\m^1_i,m^2_i,…,m^s_i\ denote the metadata (scalar) attributes. Each mijm^j_i is in the key value format mij:‘‘value”\m^j_i:``value"\ denoting the “value” assigned to the metadata attribute mijm^j_i. For example, the category attribute associated with a research paper is represented as categories:‘‘CS”\categories:``CS"\. Query model: We represent a vector query as ℚ=qv,qm,kQ=\q_v,q_m,k\, where qv∈ℝq_v ^d is the vector query on the embeddings, qmq_m is the metadata query involving zero, one, or more of the scalar attributes, and k is the number of vectors to be returned as the result. The execution of ℚQ over D returns the top-k nearest vectors to qvq_v: (1) Vk=argminS⊂,|S|=k∑vi∈Sdist(qv,vi)V_k= S ,\,|S|=karg\,min _v_i∈ Sdist(q_v,v_i) For Example, a vector query could be “Find papers that apply neural network architectures to solve optimization problems in resource-constrained environments”, while the metadata filters would be predicates such as publication_year ≥ 2020. FGAC Policy model: In our work, FGAC policies are represented as a 3-tuple following the ABAC policy model (Aserto, ). Pi=[oc,sc,act]P_i=[oc,sc,act] • ococ (Object Constraints) identify the vector on which FGAC policy is to be enforced. They are defined as a set of logical predicates defined on metadata attributes mim_i of a vector viv_i and combined with a boolean operator: oc=([mi1,op1,val1]∧[mi2,op2,val2]∧[mi3,op3,val3])∧…[mis,ops,vals])oc=([m^1_i,op_1,val_1] [m^2_i,op_2,val_2] [m^3_i,op_3,val_3]) …[m^s_i,op_s,val_s])111While object constraints can theoretically include disjunctions along conjunctions, the support for answering disjunctive metadata filters is limited in vector databases (Gollapudi et al., 2023). where op∈=,≠,≥,>,≤,<op∈\=,≠,≥,>,≤,<\ and val∈dom(mij)val∈ dom(m^j_i). From our running example, a possible set of MOCs are: ( categories = ‘CS’ ∧ license = ‘C-BY’ ∧ report_no = ‘HEP-PR-07-12’). • scsc (Subject Constraints) identify the querier for which the FGAC policy applies. Similar to metadata-based object constraints, they are defined as a set of logical predicates on subject attributes of the querying user. Examples of subject attributes include purpose of the query (Yang et al., 2007) or roles/group memberships of the user. These subject attributes are included with the query as querier metadata and used to identify the policies that apply to a given query. • actact (Action) is the access decision (act∈allow,denyact∈\allow,deny\) that is to be enforced on a vector viv_i that satisfies the vector query and applicable FGAC policies. 3. Policy-aware Vector Search In this section, we briefly discuss the the various enforcement strategies for Policy-aware Vector Search. We formalize the enforcement problem, present performance estimators, and discuss the pros and cons of different strategies. We also discuss the challenges with storage and maintenance of FGAC policies along with ideas for enforcing vector based object conditions. Enforcement Problem. The FGAC enforcement problem is to ensure that query results returned to a user satisfy all applicable policy constraints associated with the user. Given a query ℚQ posed by a user (subject) S, the set of policies that apply to the user, ℙS=Pi|sci(S)=TrueP_S=\P_i|sc_i(S)=True\. The set of vectors, VPV_P, that satisfy the applicable policies ℙSP_S for user S is given by: (2) VP=(v,m)∈|∃Pj∈PS:Pj(v,m)=TrueV_P=\(v,m) |∃ P_j∈ P_S:P_j(v,m)=True\ If the actions associated with the policies are allow, theoretically the result set Q should be equivalent to retrieving the k nearest neighbors that comply with the policy filters for the query vector qvq_v in VPV_P 222Policies with action deny requires execution of Q over −VPD-V_P. (3) VQ=argminS⊂VP,|S|=k∑vi∈Sdist(qv,vi)V_Q= S⊂ V_P,\,|S|=karg\,min _v_i∈ Sdist(q_v,v_i) Table 1. Comparison of different meta-data filtering strategies on HNSW index for policy enforcement. The superscript L denotes impact on latency and superscript R denotes impact on Recall. Property Pre-Filtering Post-Filtering (PF) Iterative PF Parallel PF Hybrid Filtering (Patel et al., 2024) Policy Correctness !20High !20High !20High !20High !20High Recall !20High !20Low !25Partial !25Partial !25Partial Query Latency !20High !20Low !25Partial !20Low !25Partial Policy Selectivity !20HighL !20HighR !25PartialR !25PartialR !20HighL Policy Correlation !20None !20HighR !20HighBoth !20HighR !20HighR Dynamic Policy !20Low !20Low !25Partial !20High !25Partial Implementation Complexity !20Low !20Low !20Low !25Partial !20High Table 1 compares four policy enforcement strategies discussed in Section 3.1: pre-filtering, post-filtering, iterative filtering, and parallel filtering. The comparison considers key characteristics, including recall, correctness, policy selectivity, policy correlation, dynamic policy handling, implementation complexity and latency. Among these, recall, correctness, policy selectivity, and latency are derived from experimental results, against the ground-truth top-k results. Policy correlation, dynamic policy handling, and implementation complexity are characterized based on the expected behavior of each enforcement strategy. Overall, this comparison highlights the inherent trade-offs between each of the strategy when enforcing fine-grained access control in vector databases (Zhu et al., 2025). In Table 1, high, partial, and low represent relative performance levels. For recall and policy correctness, they correspond to >>90%, 25–65%, and <<20% of the ground truth, respectively. For latency, selectivity, and correlation, these labels indicate high, moderate, and low cost or the alignment relative to the highest observed values on ground truth. For dynamic policy support and implementation complexity, they reflect the degree of adaptability and system overhead, respectively. Among these enforcement strategies, the system must select the strategy that guarantees policy-compliant results while achieving minimal possible query latency and maximal recall over the permitted data objects. Let S denote the set of candidate enforcement strategies and let Cost(s,ℚ,P)Cost(s,Q,P) denote the execution cost of strategy s∈Ss∈ S for a query ℚQ and its associated FGAC policies P. We formalize this as an optimization problem: s∗=mins∈Cost(s,ℚ,P)subj. ∀v∈Rs,∃Pj∈P:Pj(v)=1,Recall(Rs,ℚ,VP)≥τ.s^*= _s \ Cost(s,Q,P) . cases∀ v∈ R_s,∃ P_j∈ P:\ P_j(v)=1,\\[6.0pt] Recall(R_s,Q,V_P)≥τ. cases Only strategies capable of achieving the user-specified recall threshold are considered feasible. This optimization framework allows the system to dynamically adapt its choice of metadata strategy based on both query characteristics and user requirements, ensuring an efficient balance between retrieval accuracy and execution performance 333To evaluate the correctness of any chosen strategy, the correctness criteria, proposed by Wang et al. (Wang et al., 2007) for relational access control systems, has to be extended for vector databases. The three criteria are soundness, security, and maximality. Due to the semantic nature of vector search, they require substantial re-interpretation when used with vectors.. In this context, we emphasize that policy correctness is strictly enforced in all strategies, ensuring that only authorized results are returned. The user-specified recall threshold serves solely as a workload-level quality constraint for selecting among enforcement strategies; it does not affect correctness. Correctness is enforced independently by ensuring that only authorized results are returned. Since vector search is inherently approximate, achieving full recall can be expensive. Therefore, recall is treated as a tunable parameter for balancing efficiency and result quality, and is used to identify feasible strategies. 3.1. Strategies for Policy-aware Vector Search In this section, we explain additional strategies for Policy-aware Vector Search beyond pre-filtering and post-filtering. Iterative Post Filtering (PF) addresses the recall limitations of standard post-filtering by expanding the search space. Instead of performing a single ANN search, this strategy performs iterative search: it repeatedly retrieves candidate vectors and applies scalar filters until enough authorized results are obtained. If the filtered results are insufficient to achieve top-K result set, additional candidates are explored in subsequent iterations. This iterative expansion continues until the top-K requirement is satisfied or a allocated memory limit is reached. In HNSW, this is controlled by increasing the candidate exploration parameter hnsw.iterativescanhnsw.iterativescan, enabling a larger portion of the graph to be traversed (Lin et al., 2025). Parallel Post Filtering. We propose a parallel post-filtering approach to improve recall under selective policy constraints. Instead of expanding a single ANN search iteratively, this strategy runs multiple ANN searches concurrently to retrieve diverse candidate subsets. This improves the chance of finding policy-compliant vectors, especially in low-correlation scenarios, where vectors similar to the query are unlikely to satisfy the policy filter. In the sample dataset, we augmented each document with concept categories extracted from its title and abstract. These concepts provide an additional semantic layer for relating queries to policy constraints. We then generate concept-based query variants that remain close to the original query while guiding the search toward different regions of the vector space. This is useful in low-correlation scenarios, where vectors similar to the query are unlikely to satisfy the policy filter. Parallel post-filtering executes the original query and its concept-based variants concurrently over the HNSW index. Each candidate set is filtered using the policy predicates, and the valid results are aggregated and de-duplicated. This allows the search to explore multiple semantic regions and improve the likelihood of retrieving sufficient authorized top-K results. If the number of valid results meets the required top-K, the algorithm terminates. Otherwise, additional query variants are generated and the process is repeated. 4. Preliminary Experiments We performed experiments on PostgreSQL with the pgvector extension (Kane, 2024) installed from binaries. We used the arXiv dataset, which includes fields such as author, title, categories, license, abstract, and others (1). It has a total count of 2,771,104 records with 4.74Gb size. We used title and abstract as vector columns for embeddings, rest of columns as metadata columns and sentence-transformer model ’all-MiniLM-L6-v2’ (Reimers, 2021) to generate embeddings We compared four methods: pre-filtering (PF), naïve post-filtering (NPF), iterative post-filtering (IPF), and parallel post-filtering (PPF). For PPF we issued three parallel and medium selective queries to the HNSW index, ensuring each query explored a different region of the graph. To perform these experiments, we designed three different policy templates, combining multiple metadata columns available in the dataset. The workload generator instantiates these templates into concrete policies and ensures that each policy produces a non-empty result set. Experimental results are evaluated by measuring recall and latency across different levels of policy selectivity. Policy selectivity represents the fraction of records that satisfy a given policy filter. In our experiments, we control selectivity by specifying the number of rows in the dataset that are allowed to pass the policy filter. Experiment 1: Recall We evaluated the default pgvector behavior for both PF and NPF across all policy templates. As shown in Fig. 1(a), pre-filtering consistently achieved highest recall regardless of selectivity, while post-filtering generally produced lower recall, except in cases where the policy predicate was highly correlated with the user query. In the next experiment, we evaluated recall-versus-selectivity for all 4 strategies as shown in Fig. 1(c). PPF achieved competitive recall for medium-selective workloads, outperforming naïve post-filtering. Notably, this method achieved these recall improvements while reducing execution time compared to the iterative scan based post-filtering approach as shown next. (a) Default Recall: PF vs. NPF (b) Default Latency: PF vs. NPF (c) Recall for all 4 strategies (d) Latency for all 4 strategies Figure 1. Recall and Latency versus Selectivity for different enforcement strategies. Experimental results comparing different strategies Recall and Latency versus Selectivity for different enforcement strategies. Experiment 2: Latency This experiment compares the execution time of different enforcement strategies across different policy selectivity levels. The naïve post-filtering strategy exhibits the lowest execution time overall but it retrieves very few policy-compliant vectors, resulting in almost zero recall. Pre-filtering incurs higher execution time under low-selectivity policies because a large candidate set is passed to the vector search, offering little reduction in the distance computations performed. Conversely, under high-selectivity policies, pre-filtering becomes more efficient as the reduced candidate set meaningfully constrains the search space. The same experiment when iterative scan is enabled (Fig. 1(d)), post-filtering execution time rises sharply. Each additional scan round retrieves another batch of candidates, increasing cost substantially for low and medium selective policies. In the final comparison (Fig. 1(d)), parallel post-filtering reduces the number of search rounds required by iterative post-filtering. Instead it explored different regions of the HNSW index. This strategy delivered lower latency than iterative scan, and better recall compared to naive post-filtering for medium selectivity ranges. 5. Discussion In this section, we briefly outline the differences between FGAC & FANN and some of the possible future research directions to make Policy-aware vector research a reality. FGAC vs FANN. Fine-grained access control (FGAC) in vector databases fundamentally differs from traditional filtered approximate nearest neighbor (FANN) search. In FANN systems, filters are typically broad, low-selectivity metadata predicates attached directly to the query (Lin et al., 2025). In contrast, FGAC enforces user-specific authorization policies that may contain highly selective and complex predicate combinations (e.g., CNF/DNF policies). Unlike FANN, where the primary goals are retrieval latency and high recall, correctness of enforcement becomes the primary requirement in FGAC, since unauthorized vector retrieval can lead to sensitive data leakage. While FGAC mechanisms can support traditional filtered ANN workloads, it is unclear whether solutions designed only for FANN are sufficient for access-controlled retrieval. Cost Models for Enforcement Strategies. Our preliminary experiments on cost models to estimate query latency and recall and to guide the choice between pre-filtering and post-filtering strategies, show that highly selective predicates tend to favor pre-filtering, whereas low-selectivity scenarios benefit from post-filtering. However, many real workloads fall between these extremes. Hybrid filtering strategies can help in the intermediate stage where predicate selectivity is neither extremely high nor extremely low (Patel et al., 2024; Cai et al., 2024). A unified cost model that dynamically differentiates among all possible strategies can significantly improve plan selection, leading to more reliable latency and recall guarantees for fine-grained access control workloads. Developing such a unified cost and recall models for different strategies is an open research problem. Enforcing Vector-based Object Conditions. In this paper, we only discussed enforcement of metadata-based object conditions. Enforcing vector-based object conditions requires a different approach for supporting two independent vector queries. The correct yet costly approach could involve a dual-index strategy, employing an exact-search index (e.g., IVF-Flat) for policy vectors alongside an ANN index for query vectors, and returning the intersection of the resulting sets. An offline policy subgraph construction approach where policy-compliant vectors are pre-clustered into navigable subgraphs, similiar to ACORN (Patel et al., 2024), can structurally confine query-time search to the authorized region of the index without post-hoc filtering. A joint embedding approach that fuses policy and query embeddings into a unified representation prior to retrieval, collapsing enforcement and semantic search into a single vector operation. 6. Conclusions & Future Work Our goal is to treat Fine Grained Access Control as a first-class concern in vector databases, jointly modeling metadata and vector-level policies and introducing a cost-based framework that dynamically selects efficient enforcement strategies while meeting latency and recall requirements. To achieve this vision, access control and approximate nearest neighbor search must be co-designed from the ground up, rather than treating enforcement as a purely post-hoc layer to existing strategies and indexes. Evaluating the proposed approaches across multiple database systems and a diverse set of datasets remains as future work, to validate their robustness under varying data distributions and different system characteristics. 7. Acknowledgment This work is partially supported by the NSF Award #2451803. References [1] Cited by: §2, §4. [2] Aserto () ABAC-rbac. https://w.aserto.com/blog/rbac-vs-abac-authorization-models. Note: Cited by: §2. Y. Cai, J. Shi, Y. Chen, and W. Zheng (2024) Navigating labels and vectors: a unified approach to filtered approximate nearest neighbor search. Proc. ACM Manag. Data 2 (6). External Links: Link, Document Cited by: §1, §5. S. Gollapudi, N. Karia, V. Sivashankar, R. Krishnaswamy, N. Begwani, S. Raz, Y. Lin, Y. Zhang, N. Mahapatro, P. Srinivasan, A. Singh, and H. V. Simhadri (2023) Filtered-diskann: graph algorithms for approximate nearest neighbor search with filters. 10.1145/3543507.3583552, p. 3406–3416. External Links: ISBN 9781450394161, Link Cited by: footnote 1. A. Kane (2024) Pgvector: open-source vector similarity search for postgres. GitHub. Note: https://github.com/pgvector/pgvector Cited by: §4. Y. Lin, K. Zhang, Z. He, Y. Jing, and X. S. Wang (2025) Survey of filtered approximate nearest neighbor search over the vector-scalar hybrid data. External Links: 2505.06501, Link Cited by: §1, §3.1, §5. Y. A. Malkov and D. A. Yashunin (2018) Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs. IEEE transactions on pattern analysis and machine intelligence 42 (4), p. 824–836. Cited by: §1. P. Pappachan, R. Yus, S. Mehrotra, and J. Freytag (2020) Sieve: A middleware approach to scalable access control for database management systems. Proc. VLDB Endow. 13 (11), p. 2424–2437. External Links: Link Cited by: §1. P. Pappachan, S. Zhang, X. He, and S. Mehrotra (2022) Don’t be a tattle-tale: preventing leakages through data dependencies on access control protected data. Proc. VLDB Endow. 15 (11), p. 2437–2449. External Links: Link Cited by: §1. L. Patel, P. Kraft, C. Guestrin, and M. Zaharia (2024) Acorn: performant and predicate-agnostic search over vector embeddings and structured data. Proceedings of the ACM on Management of Data 2 (3), p. 1–27. Cited by: §1, Table 1, §5, §5. N. Reimers (2021) Sentence-transformers: all-minilm-l6-v2 External Links: Link Cited by: §4. Q. Wang, T. Yu, N. Li, J. Lobo, E. Bertino, K. Irwin, and J. Byun (2007) On the correctness criteria of fine-grained access control in relational databases. VLDB ’07, p. 555–566. External Links: ISBN 9781595936493 Cited by: footnote 3. N. Yang, H. Barringer, and N. Zhang (2007) A purpose-based access control model. In Third International Symposium on Information Assurance and Security, Vol. , p. 143–148. External Links: Document Cited by: 2nd item. H. Zhong, M. Lentz, N. Narodytska, A. Szekeres, and K. Rong (2026) Cited by: §1. J. Zhu, J. Yuan, K. Yang, X. Chen, S. Yu, H. Lv, Y. Li, and B. Zheng (2025) An experimental evaluation of hybrid querying on vectors. Proc. VLDB Endow. 19 (2), p. 183–195. External Links: ISSN 2150-8097, Link, Document Cited by: §3.