The model has no concept of who is asking
A retrieval layer returns whatever is textually similar to the question. It does not know that this user may not see that customer’s record, that contract, or that internal note. Unless permissions are enforced at retrieval, they are not enforced at all.
Filter at the index, not the answer
Restricting what the model may repeat after it has already been given the material is not a control — it is a request. The document set has to be filtered by the asking user’s permissions before retrieval, so private material is never in context.
If the model can see it, assume a customer can eventually get it to say it.
Internal notes are the usual leak
Support and CRM records mix customer-facing text with candid internal commentary. Indexing the record wholesale is the most common way an assistant ends up quoting an internal note to the customer it was written about.
Ask the question during corpus design
Deciding what must never be retrievable belongs alongside scoping what the feature actually needs. Both questions are cheap in week one and expensive after you have built an index over everything.
Log what was retrieved, not just what was said
When someone asks whether the system exposed something, the answer requires knowing which documents entered the context. That record is also what makes an incident explainable rather than a guess.
Test it adversarially before launch
Have someone deliberately try to extract material they shouldn’t have: another account’s details, pricing exceptions, internal policy. Ten minutes of this before launch is worth more than any amount of policy documentation afterwards.