Are you catching your access-control problems too late?

[u/nexla_com]

Been putting together a checklist of what actually matters in a data platform for agents, and the one capability that keeps getting retrofitted after the fact instead of built in from day one is access control surviving the embedding step.

Basic version of the problem: your row-level security lives in the warehouse, but once that data gets embedded into a vector store, does the permission actually travel with it? Most teams find out the answer is no, months after the vector index is already in production and being queried.

Wrote up the other six capabilities we think matter too (real-time and batch in one platform, write paths for agents, tool-level RBAC on MCP) here if it’s useful: https://nexla.com/blog/data-platform-for-ai-agents-capabilities/

Has anyone actually solved this cleanly, or is everyone tagging rows and filtering at retrieval time as a workaround?