harshaA document assistant can be careful in its wording and still expose information through the evidence it retrieves. Once restricted material enters the context, asking the model not to reveal it is a weak place to put the boundary.
Access decisions belong before generation, and they need to remain consistent through every retrieval stage.
Make ownership explicit
An illustrative internal assistant might serve several departments. Each document needs a tenant or ownership boundary, a version, and an access policy that the retrieval system can enforce.
The query needs the corresponding identity context. That context should come from trusted authentication and authorization state rather than a user-editable instruction such as “I belong to finance.”
Candidate retrieval, reranking, cached answers, and source links should all respect the same boundary. A secure vector query does not help if a cached response was created under another user's permissions.
Test denials as carefully as answers
A useful test asks an authorized user for a restricted fact, then repeats the same query under a different identity. The expected evidence changes, even though the words of the query do not.
Another test changes permissions after a response has been cached. A third checks a document that moved between groups or acquired a new version. These scenarios expose assumptions about ownership that a static demonstration cannot.
The test should inspect retrieved identifiers as well as the final answer. A model declining to repeat restricted text does not prove that retrieval enforced the boundary.
Keep debugging bounded
Engineers need to understand why evidence was included or excluded. That does not require copying every restricted passage into general-purpose logs.
Useful records can include policy decisions, document identifiers, and filter configuration under appropriate access controls. The principle is to preserve enough evidence for diagnosis without creating an unintended second distribution channel for the underlying content.
A retrieval system is part of the application's security model. It should behave like a data-access layer with explicit permissions, not a neutral search box followed by a polite model. The strongest protection is to avoid handing the wrong evidence to the model in the first place.