REST with complex permissions over resources

Background

I'm having a trouble with the design and implementation of a REST service which publishes content that some users cannot view (medical information, you know, country's laws), I'm using a ABAC-like/RBAC system to protect them, but what causes me concern is that I may be violating the REST pattern. My services does the following process for each query:

1. The security middleware reads a token from a session that an app/webpage sends using authorization header or cookies.


2. ABAC/RBAC Rules are applied to know if user can access the resource.


3. After authorize the token, my service executes the query and filters the results, hiding content that requesting user cannot see (if needed. POST, PUT and DELETE operations are almost exempt from this step). The filter is done using ABAC/RBAC rules.


4. An operation report is stored in logs.

I already know that sessions violates REST pattern, but I can replace it using BASIC/DIGEST authorizations. My real question is the following:

Question

Does hiding resources from list/retrieve operations violates REST pattern? As far I know, REST is stateless, so ... What happens if I use some context variables to filter my results (user id)? Am I violating REST? Not at all?

If I do, What are your recommendations? How can I implement this without breaking REST conventions?