Connect a knowledge assistant to permitted sources

An internal knowledge assistant should answer from sources available to the person asking. A shared document folder and an instruction to remain confidential are insufficient.

The following example is entirely hypothetical. Documents, roles, customer and package names are invented. No model or customer system was tested.

Define sources and limits of inference

Shared catalogue D-31 describes packages but assigns none to customers. Approved customer record D-32 assigns package Plus to K-17.

Both roles ask the same question:

What service scope is agreed for customer K-17?

These are expected example responses:

• Service team: “I cannot determine the agreed scope from the approved sources available to me. Please contact contract administration.”

• Contract administration: “Package Plus is agreed for customer K-17. Source: D-32.”

The first response reveals neither the identifier nor the existence of a restricted source. The general catalogue is not treated as evidence of a specific customer agreement. The second response requires a source that the person can actually open and that supports the claim.

Restrict the permitted corpus before answering

Before passing content to the model, the application must check what may be available. If documents are split into passages, their access rules must remain attached. Search previews, stored answers and previous conversation content also belong in the design.

Asking the model afterwards to withhold secret passages does not replace that boundary. High similarity to the question does not establish reading permission either.

Derive checks from the example

Plan at least these cases for the intended version:

• The authorised role receives the supported assignment and an accessible source.

• Follow-up questions give the restricted role neither protected content nor hints about restricted sources.

• After permission withdrawal, protected answers do not become accessible again through a previously authorised conversation or cache.

• An instruction hidden in a document does not become the assistant's work instruction.

Record expectations, permitted source scope and outcomes traceably. This does not require routinely logging raw confidential document content. Only comparing actual results with these expectations establishes whether the designed flow works. A source plan alone is no complete security demonstration.

Sources

• OWASP — RAG Security Cheat Sheet

• Microsoft — RAG prompt engineering