Follow one request through the system.
Imagine an employee asking about a policy. Sign-in establishes who they are. Authorisation determines which sources they may access and which actions the application may perform on their behalf. These are separate decisions.
Access to the AI application should not automatically mean access to every connected document or tool.
Trace the boundaries.
- At the application. Validate the authenticated session on the server. Do not trust a user identity supplied in an editable browser field.
- At retrieval. Apply access restrictions before restricted content enters the model's context. Preserve source permissions as documents are indexed and updated.
- At tool execution. Check whether the requested operation is allowed, validate its arguments and use narrowly scoped credentials.
- At consequential actions. Define which operations require a person's confirmation and what information that person must review.
- In operation. Record useful audit events, protect sensitive logs and plan how to revoke access and recover from failures.
Treat retrieved text as untrusted input.
A document can contain instructions that attempt to redirect the model. Keep external content separate from trusted system instructions. Use application controls to enforce tool permissions; a prompt is not an authorisation boundary.
Try a permission test.
In the retrieval lab, choose the restricted-source question. Switch between Employee and Finance reviewer. The displayed evidence changes because the synthetic source carries an access rule.
The browser control is an educational simulation. A production system must enforce the equivalent check on a trusted server, using verified identity.
Put it into practice
Draw an access boundary you can test.
Use fictional documents and two roles. Give one role access to all documents and restrict the other to a subset.
- Run the same question as each role and inspect which passages reach the model.
- Repeat the check for direct links, search previews, conversation history and citations.
- Write down the expected denial behaviour before you run the test.
A permission matrix and a repeatable test for every path that can reveal document content.