{
  "version": 1,
  "synthetic": true,
  "updatedAt": "2026-09-14",
  "source": "https://anandcandassamy.com/articles/rag-droits-acces-filtrer-avant-repondre",
  "policy": "Compte actif et organisation connue ; document actif de la même organisation ; portée organisation ou autorisation nominative/groupe. Une liste d’autorisations vide reste fermée pour un document restreint.",
  "documents": [
    {
      "id": "commun-a",
      "tenant": "a",
      "active": true,
      "scope": "organisation",
      "groups": [],
      "users": []
    },
    {
      "id": "rh-a",
      "tenant": "a",
      "active": true,
      "scope": "restreint",
      "groups": [
        "rh"
      ],
      "users": []
    },
    {
      "id": "finance-a",
      "tenant": "a",
      "active": true,
      "scope": "restreint",
      "groups": [
        "finance"
      ],
      "users": []
    },
    {
      "id": "prive-alice",
      "tenant": "a",
      "active": true,
      "scope": "restreint",
      "groups": [],
      "users": [
        "alice"
      ]
    },
    {
      "id": "commun-b",
      "tenant": "b",
      "active": true,
      "scope": "organisation",
      "groups": [],
      "users": []
    }
  ],
  "cases": [
    {
      "id": "organisation",
      "objective": "Accès aux documents communs de son organisation",
      "principal": {
        "id": "lecteur",
        "tenant": "a",
        "active": true,
        "groups": []
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a"
      ]
    },
    {
      "id": "groupe-rh",
      "objective": "Accès au groupe RH et à une autorisation directe",
      "principal": {
        "id": "alice",
        "tenant": "a",
        "active": true,
        "groups": [
          "rh"
        ]
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a",
        "rh-a",
        "prive-alice"
      ]
    },
    {
      "id": "groupe-finance",
      "objective": "Accès au groupe Finance",
      "principal": {
        "id": "ben",
        "tenant": "a",
        "active": true,
        "groups": [
          "finance"
        ]
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a",
        "finance-a"
      ]
    },
    {
      "id": "autre-organisation",
      "objective": "Isolation entre deux organisations",
      "principal": {
        "id": "carla",
        "tenant": "b",
        "active": true,
        "groups": []
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-b"
      ]
    },
    {
      "id": "anonyme",
      "objective": "Absence de principal authentifié",
      "principal": null,
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": []
    },
    {
      "id": "compte-revoque",
      "objective": "Désactivation du compte",
      "principal": {
        "id": "alice",
        "tenant": "a",
        "active": false,
        "groups": [
          "rh"
        ]
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": []
    },
    {
      "id": "groupe-retire",
      "objective": "Retrait du groupe RH, autorisation directe conservée",
      "principal": {
        "id": "alice",
        "tenant": "a",
        "active": true,
        "groups": []
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a",
        "prive-alice"
      ]
    },
    {
      "id": "acces-direct-retire",
      "objective": "Retrait d’une autorisation nominative",
      "principal": {
        "id": "alice",
        "tenant": "a",
        "active": true,
        "groups": [
          "rh"
        ]
      },
      "documentOverrides": {
        "prive-alice": {
          "users": []
        }
      },
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a",
        "rh-a"
      ]
    },
    {
      "id": "document-supprime",
      "objective": "Document désactivé retiré des résultats",
      "principal": {
        "id": "alice",
        "tenant": "a",
        "active": true,
        "groups": [
          "rh"
        ]
      },
      "documentOverrides": {
        "rh-a": {
          "active": false
        }
      },
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-a",
        "prive-alice"
      ]
    },
    {
      "id": "organisation-absente",
      "objective": "Principal sans organisation",
      "principal": {
        "id": "alice",
        "tenant": null,
        "active": true,
        "groups": [
          "rh"
        ]
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": []
    },
    {
      "id": "groupes-homonymes",
      "objective": "Un même nom de groupe ne traverse pas les organisations",
      "principal": {
        "id": "carla",
        "tenant": "b",
        "active": true,
        "groups": [
          "rh",
          "finance"
        ]
      },
      "documentOverrides": {},
      "candidateIds": null,
      "expectedDocumentIds": [
        "commun-b"
      ]
    },
    {
      "id": "cache-autre-lecteur",
      "objective": "Réévaluer les droits sur des candidats venant d’un autre lecteur",
      "principal": {
        "id": "ben",
        "tenant": "a",
        "active": true,
        "groups": [
          "finance"
        ]
      },
      "documentOverrides": {},
      "candidateIds": [
        "commun-a",
        "rh-a",
        "prive-alice"
      ],
      "expectedDocumentIds": [
        "commun-a"
      ]
    }
  ]
}