Policy enforcement for search engines

A non-transitory computer readable storage medium storing instructions executable by a data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:

• receiving, by a policy engine, credentials associated with a search query comprising one or more query terms that include a search query term, the credentials identifying a user issuing the search query;
• receiving, by the policy engine, an intermediate representation of the search query generated by a preprocessor of a search engine, the intermediate representation comprising one or more index terms as a normalized text string corresponding to the one or more query terms the normalized text string including a normalized query term that is a variation of the search query term;
• determining, by the policy engine based on a policy specifying user access privileges, that the user is prohibited from accessing data associated with a particular index term;
• identifying, by the policy engine, that the normalized query term is the same as the particular index term;
• in response to said identifying, modifying the intermediate representation by the policy engine by negating the normalized index term in the intermediate representation;
• and
• submitting the modified intermediate representation by the policy engine to a query processing module of the search engine, the query processing module operable to generate one or more search results, based on the modified intermediate representation, that exclude content corresponding to the particular index term and the search query term, wherein the policy engine comprises one or more computer processors.

A system comprising:

• one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
• receiving, by a policy engine, credentials associated with a search query comprising one or more query terms that include a search query term, the credentials identifying a user issuing the search query;
• receiving, by the policy engine, an intermediate representation of the search query generated by a preprocessor of a search engine, the intermediate representation comprising one or more index terms as a normalized text string corresponding to the one or more query terms, the normalized text string including a normalized query term that is a variation of the search query term;
• determining, by the policy engine based on a policy specifying user access privileges, that the user is prohibited from accessing data associated with a particular index term;
• identifying, by the policy engine, that the normalized query term is the same as the particular index term;
• in response to said identifying, modifying the intermediate representation by the policy engine by negating the normalized index term in the intermediate representation;
• and
• submitting the modified intermediate representation by the policy engine to a query processing module of the search engine, the query processing module operable to generate one or more search results, based on the modified intermediate representation, that exclude content corresponding to the particular index term and the search query term.