Retrieval Blast Radius

A misconfigured permission on a folder exposes that folder. A misconfigured entitlement in a retrieval system exposes whatever a question can reach, which may span repositories and is bounded only by the phrasing of queries nobody has tried yet. The difference in blast radius is why entitlement errors in AI are qualitatively worse than in document management, and why the assurance question shifts from what did we permit to what could have been reached.

Because entitlement in Centralpoint is carried by records and material excluded at index time is not embedded at all, the blast radius of a rule error is bounded by construction rather than by filter coverage. The Interaction Log records what was retrieved per execution, so the actual exposure from a misconfiguration is measurable rather than estimated during an incident.