SolutionWhen you index BCS entitiy models. SharePoint adds a hidden managed property named entityname to the search schema. This managed property contains the name of the BCS entity being indexed, and is not set for the toplevel BCS items. Hence you can add a filter of entityname:modelname to make sure you filter on exactly what you want, instead of filtering on contentsource.
TL;DR section with an explanationYou have created your BCS models and made them available for indexing, and you might even have added security descriptors to the data being indexed. Here’s my entity called Deviation which fetches data from a SQL database.
Next up you create a content source and configure your search web part to filter items on:
If I search with a user with no access to this model I get the following two hits using the SharePoint Query tool.
As you can see the path of the item is bdc3://deviation_deviation which matches the model and entity name. If I instead query on entityname:deviation, I get zero hits with this user.
How did I discover this? See that link called “View all properties” for the search result? I compared the output for a top level hit and an actual item, I noticed the managed property and value. So for BCS models it’s better to filter on the managed property entityname instead of the managed property contentsource.