RAG access control: 3 ways to enforce document permissions in AI apps

On-behalf-of tokens (Databricks), live ACL re-checks (AWS), and parent-level fine-grained authorization: how each keeps an AI assistant from showing users data they can't access, and when to use which.