You build an internal HR assistant over policy documents, and some documents are visible only to certain departments. Where must you enforce access control?

Options

1. In the system prompt: "only show documents the user may see"
2. At retrieval time: filter the search by the user's permissions, so unauthorized text never reaches the prompt (Correct option)
3. After generation, by scanning the answer for forbidden words
4. By encrypting the embeddings

Answer

At retrieval time: filter the search by the user's permissions, so unauthorized text never reaches the prompt

Why

Whatever is in the prompt can end up in the answer, whether through a normal question or an injection. The model cannot be trusted to keep secrets it has been shown.

So the permission filter belongs in the retrieval step (for example a metadata filter in the vector search), using the identity of the real user.

Output scanning is a useful extra layer but a weak primary control.

Remember

Enforce permissions before text reaches the model.

Key terms

• RAG (retrieval-augmented generation)
• Prompt injection
• Least privilege