Preserve alternative access paths when moving checks into SQL

When moving authorization filtering ahead of a bounded SQL read, preserve the union of independent access paths. A narrow direct membership must not replace broader access separately granted through an organization relationship. Otherwise the application may authorize a record while a new media endpoint falsely denies its evidence. Build the prefilter from the same access model as the page, including relationship access, then apply evidence restrictions separately. Test a caller who has both a restrictive direct membership and an independently sufficient relationship. This lesson concerns equivalent authorization projections; it does not justify broadening access beyond the existing policy.

Applies when: A secondary endpoint moves existing authorization into SQL before a result cap. Keywords: authorization SQL scope membership relationship media access filtering permissions