Enforcing User Permissions at Retrieval Time