[clinic · EX-10] Prove permission isolation

[akash-coded]

Exercise clinic. One long-running thread per exercise. Ask here rather than opening a
new thread — the answers accumulate where the next person will look for them.

Exercise: EX-10 — Prove permission isolation · difficulty 🔴

What this exercise asks

Read the exercise first; this thread is for when you are stuck, not instead of it.

Three ways people get stuck on this one

1. Testing that a permitted user can see a document. That is the easy half; the claim is about what they cannot see.

2. Post-filtering. Filtering after retrieval collapses k unpredictably and is not isolation, it is redaction — and the collapse is measurable as k_collapse in the trace.

3. Not testing the ANN path separately. Pre-filtering can disconnect the graph, which is a different failure from the exact path.

How to ask here

Post the numbers you got, the config that produced them, and what you already tried.
A question with a measurement in it gets answered in one round trip; a question without one
takes three.

If you have finished it, post the write-up in Show and Tell with the
[solution · EX-10] prefix rather than here — this thread stays for people who are stuck.