PostgreSQL + pgvector (pip install "needtoknow[pgvector]", pgvector 0.8+). The permission filter runs inside the SQL query as JSON containment tests, served by a GIN index, and iterative index scans keep HNSW returning k rows under selective filters.

from psycopg_pool import ConnectionPool

from needtoknow.backends.pgvector import PgVectorBackend, create_schema

pool = ConnectionPool("postgresql://localhost/app")
create_schema(pool, dim=768)
backend = PgVectorBackend(pool, embed=my_embedding_model)  # embed: str -> list[float]
backend.add(documents)

Chroma (pip install "needtoknow[chroma]"). The filter becomes Chroma's where clause. Each value in a permission list is stored as its own field rather than as a Chroma array, and an exact copy of the metadata is kept for the re-check: in chromadb 1.5.x, deleting a collection leaves its array metadata behind for new records in other collections to pick up (chroma-core/chroma#7594), which for permissions would be a leak.

import chromadb

from needtoknow.backends.chroma import ChromaBackend

collection = chromadb.PersistentClient(path="./chroma").get_or_create_collection("docs")
backend = ChromaBackend(collection)  # uses the collection's embedding function

Qdrant (pip install "needtoknow[qdrant]"). The filter becomes Qdrant's query_filter, served by payload indexes on the permission fields. Points use the layout of LangChain's Qdrant integration, so a collection built with LangChain can be searched with permissions as it is.

from qdrant_client import QdrantClient

from needtoknow.backends.qdrant import QdrantBackend, create_collection

client = QdrantClient(url="http://localhost:6333")
create_collection(client, "docs", dim=768)
backend = QdrantBackend(client, "docs", embed=my_embedding_model)

create_collection(..., text_search=True) adds a BM25 sparse vector, and QdrantBackend(client, "docs", mode="keyword") then ranks by BM25 under the same filter, for hybrid search with RankFusion.

Milvus (pip install "needtoknow[milvus]"). The filter runs inside Milvus's vector search. Permissions are matched on a type-tagged array field, and the values are passed as filter parameters, never written into the expression, so a group name cannot change what a filter selects.

from pymilvus import MilvusClient

from needtoknow.backends.milvus import MilvusBackend, create_collection

client = MilvusClient(uri="http://localhost:19530")
create_collection(client, "docs", dim=768)
backend = MilvusBackend(client, "docs", embed=my_embedding_model)

create_collection(..., text_search=True) also derives a BM25 sparse vector from the text, and MilvusBackend(client, "docs", mode="keyword") then searches it under the same filter, for hybrid search with RankFusion.

MongoDB Atlas Vector Search (pip install "needtoknow[mongodb]"). The filter is the $vectorSearch pre-filter, on a type-tagged array field. Atlas indexes writes a moment after they happen, so add and delete wait until the index shows them, including a chunk's new permissions.

from pymongo import MongoClient

from needtoknow.backends.mongodb import MongoDBBackend, create_search_index

collection = MongoClient(MONGODB_URI)["rag"]["chunks"]
create_search_index(collection, dim=768)
backend = MongoDBBackend(collection, embed=my_embedding_model)

create_text_index(collection) adds an Atlas Search index on the text, and MongoDBBackend(collection, mode="keyword") then runs BM25 under the same filter, for hybrid search with RankFusion.

Weaviate (pip install "needtoknow[weaviate]"). The filter runs inside Weaviate's vector search, on a type-tagged text[] property with field tokenization, so terms match exactly, case and whitespace included. The metadata is stored as JSON and returned as written.

import weaviate

from needtoknow.backends.weaviate import WeaviateBackend, create_collection

client = weaviate.connect_to_local()
create_collection(client, "Chunks")
backend = WeaviateBackend(client, "Chunks", embed=my_embedding_model)

Redis (pip install "needtoknow[redis]"). A KNN query on the Redis Query Engine (Redis 8 or later, or Redis Stack) with the permission filter in the same query. Permission terms are stored hex-encoded, so no group name can add query syntax and case never merges two values.

import redis

from needtoknow.backends.redis import RedisBackend, create_index

client = redis.Redis.from_url(REDIS_URL)
create_index(client, "chunks", dim=768)
backend = RedisBackend(client, "chunks", embed=my_embedding_model)

create_index(..., content_field="content") also indexes the text, and RedisBackend(client, "chunks", mode="keyword") then runs BM25 under the same filter, for hybrid search with RankFusion.

LanceDB (pip install "needtoknow[lancedb]"). An embedded vector database, on a local directory or object storage, with no server to run. The permission filter is applied before the vector search ranks, on hex-encoded terms, so no group name or user id is ever part of the SQL.

import lancedb

from needtoknow.backends.lancedb import LanceDBBackend, create_table

table = create_table(lancedb.connect("data/chunks"), "chunks", dim=768)
backend = LanceDBBackend(table, embed=my_embedding_model)

create_indexes(table, content_field="content") builds a full-text index, and LanceDBBackend(table, mode="keyword") then runs BM25 under the same filter, for hybrid search with RankFusion.

Elasticsearch and OpenSearch (pip install "needtoknow[elasticsearch]" or [opensearch]). The filter runs inside the kNN search. Permissions are matched on a type-tagged keyword field, so the integer 1 and the string "1" stay different values, as the reference semantics require.

from elasticsearch import Elasticsearch

from needtoknow.backends.elasticsearch import ElasticsearchBackend, create_index

client = Elasticsearch("http://localhost:9200")
create_index(client, "docs", dim=768)
backend = ElasticsearchBackend(client, "docs", embed=my_embedding_model)

mode="keyword" runs BM25 on the same index under the same filter. RankFusion(vector, keyword) fuses the two into hybrid search, and fuses any other backends the same way (hybrid search).

Open Policy Agent (no extra dependency). Your Rego policy returns one decision per chunk, and can optionally return a filter so the vector store does the filtering. A complete policy is in examples/opa/needtoknow.rego.

from needtoknow.authorizers.opa import OPAAuthorizer

authorizer = OPAAuthorizer("http://localhost:8181", filter_path="needtoknow/filter")

OpenFGA (no extra dependency). Relationship-based access control in the Google Zanzibar style. Checks run in batches; for pre-filtering, ListObjects returns every document the user may view, and if that list may have been truncated the retriever post-filters instead. The subject's groups can be sent as contextual tuples, so memberships from your identity provider need no syncing.

from needtoknow.authorizers.openfga import OpenFGAAuthorizer

authorizer = OpenFGAAuthorizer("http://localhost:8080", store_id, resource_field="doc_id")

SpiceDB (no extra dependency). Zanzibar-style permissions through SpiceDB's HTTP API. CheckBulkPermissions decides each chunk, LookupResources gives the pre-filter, and the subject's groups are checked as subject sets (group:<name>#member), so memberships from your identity provider need no syncing.

from needtoknow.authorizers.spicedb import SpiceDBAuthorizer

authorizer = SpiceDBAuthorizer("http://localhost:8443", token=spicedb_key, resource_field="doc_id")

Cerbos (no extra dependency). Each chunk is a Cerbos resource whose attributes are its metadata. Pre-filters come from Cerbos query plans: the conditions a vector store can apply exactly are translated into a filter, and anything else is post-filtered with Cerbos deciding each chunk. An example policy is in examples/cerbos.

from needtoknow.authorizers.cerbos import CerbosAuthorizer

authorizer = CerbosAuthorizer("http://localhost:3592")

Google Drive (bring google-api-python-client). GoogleDriveACL reads who may read a Drive file, in My Drive or a shared drive, and with_access writes it onto the file's chunks for MetadataACLAuthorizer. Grants that do not open the content fail closed: link-only sharing, deleted accounts, expired grants, limited-access folders' metadata views and grants a shared drive shuts out grant nothing.

from needtoknow.sync import with_access
from needtoknow.sync.google_drive import GoogleDriveACL

access = GoogleDriveACL(drive_service, domains=["example.com"]).access(file_id)
backend.set_metadata({cid: with_access(metadata, access) for cid, metadata in chunks.items()})

LangChain (pip install "needtoknow[langchain]"). NeedToKnowRetriever is a LangChain retriever, so it works in chains, agents and LangGraph tools; LangChainVectorStoreBackend turns any LangChain vector store into a needtoknow backend (post-filtered).

from needtoknow.langchain import NeedToKnowRetriever

retriever = NeedToKnowRetriever(retriever=PermissionedRetriever(backend, authorizer))
docs = retriever.invoke("What are this year's salary bands?", subject=Subject("bob", ["sales"]))

LlamaIndex (pip install "needtoknow[llamaindex]"). NeedToKnowRetriever for query and chat engines, PermissionNodePostprocessor for existing pipelines, and LlamaIndexBackend to wrap an existing index. Runnable examples for both frameworks are in examples/.

Haystack (pip install "needtoknow[haystack]"). NeedToKnowRetriever is a pipeline component over any needtoknow backend and authorizer. The authenticated user is a run input, so one pipeline serves every user; it outputs documents and complete, and has run_async.

from haystack import Pipeline

from needtoknow.haystack import NeedToKnowRetriever

pipeline = Pipeline()
pipeline.add_component("retriever", NeedToKnowRetriever(PermissionedRetriever(backend, authorizer)))
result = pipeline.run({"retriever": {"query": question, "subject": subject}})

MCP (pip install "needtoknow[mcp]"). add_search_tool gives an MCP server a search tool for AI assistants and agents. Whose permissions apply comes from the access token the server verified, never from the tool's arguments, and a call without a verified token is refused.

from needtoknow.mcp import add_search_tool


def subject_for(token):  # the verified token's user, with their groups
    return Subject(token.subject, groups_of(token.subject))


add_search_tool(server, PermissionedRetriever(backend, authorizer), subject_for)
server.run(transport="streamable-http")