Use the built in query filtering to allow things like XACML restrictions to work.