Three engines, one permission clause

What it is, and what it is not

Three ways of asking, presented as one screen. Structured attribute query for when you know the field and the value. Full text across documents and object content for when you remember a phrase. Semantic similarity for when you can describe the thing but not name it.

It is not three features on three tabs with three sets of results to reconcile. Which engine to use is not a question anybody arrives with, so the screen offers ways of asking rather than a choice of technology.

It is also not a separate index with its own idea of who can see what. That is the part most search implementations get wrong, and it is the part that is expensive to fix afterwards.

The mechanism: filtered at query time

The choice was between partitioning the index by permission at write time and filtering at query time. Manufacturing PLM filters at query time, for two reasons that are worth stating because the trade-off is real.

First, a permission change under index-time partitioning means re-indexing. Somebody joins a programme on Tuesday and the search index has to be rebuilt before they can find anything, which in practice means permissions and search drift apart.

Second, and decisively: attribute-level access control does not partition at all. A user permitted to see a part but not its cost cannot be expressed as membership of an index partition, because the unit of partitioning is the document and the unit of the rule is the field.

Results, totals, facet counts and pagination all derive from one where clause. Not three that agree today — one. A total of twenty-nine above twenty-six visible rows announces the existence of three objects as loudly as listing them would, so they are not permitted to be computed from different sets.

The failure it prevents

A contractor is given access to one programme. They search for a competitor's product name — out of curiosity, or because it was mentioned in a meeting — and get no results, correctly. The facet panel beside the empty list says Programme: 14.

Nothing was disclosed in the ordinary sense. No part number, no document, no drawing. But the existence of fourteen objects under a programme they cannot open is now known, and existence is frequently the sensitive part — in an acquisition, in a customer-confidential build, in anything under NDA.

The same class of leak hides in autocomplete endpoints, export jobs running outside a request, and aggregate reports over tables the ordinary screens never touch. Deriving every one of those from the same clause is the only fix that does not depend on somebody remembering.

How it meets the rest of the product

Semantic search runs on embeddings that carry the revision of the object they were made from, and superseded revisions are invalidated rather than left to age. Without that, the first time a part revises, similarity search begins answering about a design that no longer exists — fluently, with nothing to notice it by.

Full-text ranking uses a raw ranking query, and a raw query does not pass through the client extension that injects the tenant predicate. Rather than hand-deriving the predicate inside the SQL, ranked identifiers are intersected with a set the ordinary client has already filtered. An access-control rule buried in a SQL string is a rule nobody reviews.

Saved searches are objects, shareable by user, team, role or tenant, and they carry permissions of their own. Agents search through the same path with the asking user's permissions, so an agent cannot surface something the person could not find themselves.

How it meets your ERP

Search covers what Manufacturing PLM holds, including the ERP-sourced context it caches — a part's on-hand quantity or lead time is filterable, so “fasteners with more than twelve weeks lead time used in shipping products” is a query rather than an export and a spreadsheet.

Those values are labelled with their source system and an as-of stamp wherever they appear in results, because a cached read of somebody else's master record is a weaker fact than one Manufacturing PLM owns and the interface should not blur the difference.

What search does not do is federate live into your ERP. It searches the context that has been read back on the configured schedule, not the ERP's own database — which keeps result latency predictable and means a search never depends on a third-party system being up.

Where the boundary is

Administrators are not special-cased. An administrator who needs into a restricted programme grants themselves access and leaves an audit row saying they did, rather than holding a silent bypass that no report would ever surface.

Semantic search also does not read CAD geometry. It works over text, attributes and document content; finding a part by shape is a question for the CAD system, and Manufacturing PLM links out rather than implying an ability it does not have.