ADR-020 — Weaviate native security

항목	값
Status	Proposed (2026-05-25 — #512 design step)
Related Epic	#512, #505 Phase 6
Related ADR	ADR-019 (#505 14-phase parent)

한 줄 결정: Weaviate native OIDC (Keycloak) + RBAC + 컬렉션 분할 + Where 필터의 4-축 보안. ABAC 후처리는 GenD DataAccessService 가 결과 row 단위 마지막 가드.

결정

1. OIDC: Weaviate native OIDC (Keycloak issuer) — gend-api JWT 가 그대로 통과.
2. RBAC: Weaviate v1.31+ RBAC API — viewer/editor/admin role + read_collection/write_collection/delete_object permissions.
3. 컬렉션 분할: CatalogChunk_<workspace_slug> (#1018 workspace 격리 prereq). cross-workspace traversal 차단.
4. Where 필터: ABAC 메타데이터 (security_level, llm_clearance) 를 Where 절로 주입 → engine-level filter.
5. fallback: GenD DataAccessService.filter_visible_* 가 최종 row 가드 (defense in depth).

비목표

• Weaviate cross-cluster replication 별도. backup encryption 별도.