An internal assistant can produce an accurate answer and still reveal information to the wrong person. Connecting a shared document library to a model introduces another route to that information. The access rules people rely on in the source system must also govern what the assistant retrieves.
Carry access rules with the content
Imagine a company wiki containing general onboarding notes and a restricted acquisition plan. When documents are split into searchable passages, each passage needs the relevant access metadata. Resolve the caller’s identity on the server and restrict retrieval before any content reaches the model.
Microsoft documents a security-filter pattern for Azure AI Search. The filter itself is not an authentication mechanism: the application must establish the caller’s identity and construct trustworthy filtering conditions. A prompt asking the model to respect confidentiality cannot replace that boundary.
Follow permissions beyond the first answer
Check generated summaries, conversation history, downloaded exports, and cached responses. A cache shared across users can bypass otherwise correct retrieval rules. Include authorization context in the cache design and recheck access when a saved answer is reopened.
Changes matter too. Establish how revoked permissions and deleted documents reach the index. If the source stops synchronizing, decide which content should become unavailable instead of silently treating old access information as current.
Test with users who should see different results
Create test accounts for an employee, a restricted project member, and a departed contractor. Ask the same question through each account, including questions about document titles and citations. Repeat after removing access. Treat any restricted snippet in an answer, preview, or export as a failed authorization test, even when the main response refuses to answer.
