An assistant surfaces confidential documents to staff who should not see them. Where is the fix?
Why D is the answer
Permission checks at retrieval, based on the user's identity
Data the model never receives cannot leak. Filtering by the user's access at retrieval is the control that holds.
In detail
- Data the model never receives cannot leak.
- Filtering by the user's access at retrieval is the control that holds.
- Test with accounts at each permission level.
Use case
An illustrative scenario, not a real incident.
An assistant shows salary documents to all staff. Filtering by the user's access at retrieval means those files never reach the model for most people.
See it in different ways
sequenceDiagram participant U as User participant A as Agent participant S as Source system U->>A: Request with user identity A->>S: Call scoped to that user S-->>A: Only what the user may see
sequenceDiagram participant U as User participant A as Assistant participant S as Source system U->>A: Question, with identity A->>S: Query, scoped to that user S-->>A: Only permitted documents A-->>U: Answer S->>S: Audit log names the user
sequenceDiagram participant P0 as User participant P1 as Retriever participant P2 as Model P0->>P1: Question, with identity P1->>P2: Only permitted passages P2-->>P0: Answer
Key point: What the model never receives cannot leak.
Why the other options are wrong
- A. A system prompt telling the model not to reveal confidential documents
- A prompt is not a security boundary.
- B. A filter on the final answer that scans each reply for words like confidential or restricted
- Word filters miss sensitive content that is not labeled.
- C. A notice in the interface that reminds staff of the information policy
- A notice does not stop anything from being shown.