The first demo of an internal knowledge assistant usually indexes a shared folder and answers beautifully. The first real deployment reveals the problem: the index doesn't know that the board minutes, salary files and HR cases in the same drive are not for everyone. Once the model has read a document, it can paraphrase it for anybody who asks the right question.
Filter before the model sees anything
The rule is simple to state and easy to get wrong: a user's permissions must be applied when passages are retrieved, so the model only ever receives text that person may see. Filtering the answer afterwards is too late, because the content has already shaped it.
How to build it
- Carry permissions with the content — every chunk in the index keeps the access rules of its source document: owner, groups, sharing settings.
- Resolve identity at query time — the system knows who is asking, and filters retrieval to chunks that identity can read, using the source system's own permission model.
- Sync changes quickly — when access is revoked or a document is reclassified, the index must follow in minutes or hours, not weeks. Stale permissions are a quiet leak.
- Respect deletions — removing a document from the source must remove its chunks and any cached answers derived from it.
- Keep caches per audience — a cached answer that was generated for one permission group must not be served to another.
Test it like an attacker would: sign in as a low-privilege user and ask directly for salaries, legal disputes and unreleased plans. Then ask indirect questions that would reveal the same facts. The test set should include these cases permanently.
Cite, and show the boundary
Answers should name the documents they came from, and the system should be explicit when it can't answer because of access rather than implying the information doesn't exist. 'I couldn't find an answer you have access to' is honest, and it gives the person a path: ask the owner or request access.
Why it matters beyond the leak
Staff adopt an assistant they trust. A single episode of surfacing something sensitive ends that trust, and often the project. Building permissions into retrieval from the first version is cheaper than adding it after an incident, and it turns a security review from an obstacle into a formality.