The stored citation is a record of a decision, not a grant of one. At write time the live turn passes entitlement toggles, a fail-closed per-document view gate, and identity taken only from the JWT [8]. What lands in the database is that check's output, pinned onto the audit event that produced it so the transcript endpoint can replay it verbatim [7]. Weeks later the endpoint selects those rows and renders the cards again, and the rows carry none of the machinery that authorized them [9]. The author's phrasing for this is that persistence is not permission: what a turn was allowed to show at write time proves nothing about what it may show at read time [3].
Drift is what makes it operational. In this product, tenant admins hold two switches, the copilot itself and, separately, the document-search capability that produces the source cards [10]. Between the day a turn is written and the day it is replayed, weeks pass, toggles flip and contracts change [11]. Put the fail-closed rule and the graceful-degradation rule against those two switches and a single stored transcript has three legal renderings at read time: full replay, conversation text with the cards withheld, and a flat not-found [1]. The row set is identical in all three.
Denial is the cheap path. The coarse gate loads the tenant's entitlements at the top of every history read and refuses before touching a session row [12], and the author's test pins that the session and turn queries are never awaited when the toggle is off [16]. A refused read therefore costs one entitlement lookup and zero document-derived reads [2]. Authorization that runs before the query is also authorization a caller cannot skip by arriving with a valid session id.
Two of the choices will draw argument. The service re-checks even though a gateway in front of it is already gating, on the reasoning that an assumption held in another codebase is not a control [14]; reroute traffic or add a caller and the rule is somewhere else. And entitlement denial answers 404, the same uniform not-found the turns endpoint already returns for malformed, unknown and foreign session ids [15], so a denied caller is not told there is something present to want [5].
What the post demonstrates and what it asserts are not the same size. The published code is the tenant-level gate, which refuses unless the AI and copilot entitlements are both on [13]. The finer-grained behaviour, withholding document-derived cards while keeping the conversation text, is stated as the design rule [4] rather than shown running. It is one developer describing two weeks of work on one streaming-first document-search copilot [6]. The general claim, that every RAG product persisting retrievals has this door and the only open question is whether anyone put a lock on it [17], is cheap enough to test against your own transcript endpoint.
