title: Query documents with access control filter
body: <p>Each document in my Elasticsearch index has two access control lists containing user ids. One is an allow list, the other is a deny list. I am trying to add a filter to a given query that considers these ACLs. I thought I could use a <code>bool</code> query with a <code>must</code> clause for the given query, a <code>filter</code> clause for the allow list, and a <code>must_not</code> clause for the deny list. What I have so far (example for user 1):</p>
  
  <pre><code>{
  "bool" : {
  "must" : {
    [given query]
  },
  "filter" : [ {
    "match" : {
      "acl.allow" : {
        "query" : "/user/1",
        "type" : "boolean"
      }
    }
  }],
  "must_not" : [ {
    "match" : {
      "acl.deny" : {
        "query" : "/user/1",
        "type" : "boolean"
      }
    }
  }]
  }
  }
  </code></pre>
  
  <p>Unfortunately, this query does not return the desired result. It returns objects that have not listed user 1 in their allow list (a behavior I don't understand). Also, it (obviously) ignores objects with empty access control lists (which should be visible to anyone). Any suggestions to fix that?</p>