Bound candidate generation and authorization together
Approximate nearest-neighbor candidate generation alone is insufficient when authorization still evaluates every revision. Bound both candidate generation and authorization with bounded or set-based plans. This is a scalability design constraint, not a claim about relevance or be…