Use the built in query filtering to allow things like XACML restrictions...

... to work.