A computer-implemented method comprises creating and storing a plurality of different access group identifiers each associated with one or more user account identifiers, and a plurality of different classification markings each representing a different access restriction for an electronic document, and associating each of the user account identifiers with one or more of the classification markings; indexing each particular electronic document among a plurality of different electronic documents in association with values of one or more of the access group identifiers and with an inverse list of values of the classification markings that apply to the particular electronic document in a classification index; receiving a search query that specifies one or more attributes of electronic documents; obtaining one or more first classification markings, among the plurality of classification markings, which are associated with a particular user account identifier that is associated with the search query; executing a search of the classification index based on the search query using a covering query that requires a specified minimum number of matches between the one or more first classification markings and one or more second classification markings that are associated with a particular electronic document, and adding the particular electronic document to a result set of the search only when the covering query is satisfied; providing the result set in response to the search query.