Section 8: The Index Narrows, the Owner Decides - Deep Dive: Permission-Aware Tag Pages

Executive Summary: The tag page is the one query where the tagging service reads content it doesn't own, under permissions it doesn't hold. This section builds it as a three-layer funnel (tenant boundary, cached container set, owner hydration), picks scan or merge per (user, tag) with a cost formula, serves both with one keyset cursor, over-fetches 30 to show 25, and closes or bounds every side channel. Dana, Priya and Sam click the same tag and see 4, 3 and 2 items, and no item reaches anyone who may not see it.

The interviewer leans in.

Interviewer: "Good, the index is true. Now Sam clicks checkout-outage. Sam's a contractor. What do they see, and how fast?"

You: "Two items, PAY-4312 and PR 881, inside the 300 ms p95. The interesting part is the two they don't see, because each disappears at a different layer. The index narrows, the owner decides."

The Three-Layer Funnel

Each layer can only remove candidates, and each is cheaper than the next:

1. The tenant is a hard boundary. tenant_id comes from the token and leads every key, so Bluefin's query can't even address Meridian's rows, at zero cost.
2. The container filter narrows. Every assignment carries container_id, and the read keeps only rows in the user's accessible-container set. The postmortem drops out here: it lives in the SRE space, which Sam can't see.
3. The owner decides. Survivors go to the owning product's batch hydration, which returns items only if the user may see them right now. PAY-4315 drops out here: Sam can see PAY, but its "Security team only" level is Jira's business, and Jira says no. At p99 150 ms per call, this layer runs on 30 candidates, not 30,000.

We never model issue security levels or page restrictions. One restricted bit steers counts; for display, a restricted item is just a candidate its owner might reject.

Key Insight: A layer that is wrong in the generous direction costs a wasted hydration slot. A layer that is wrong in the strict direction hides an item: up to 60 s for a stale set, up to 10 s p99 for a delayed content-event, or until reconciliation if the event is lost. Neither can show an item, because the only layer that can say yes is the owner.