Search quality is not the first control
An internal knowledge assistant can answer accurately and still create a security incident. The critical question is whether the retrieval layer preserves the permissions, retention and ownership of every source through ingestion, indexing, ranking, generation and citation.
Carry identity into retrieval
Authorisation should be evaluated at request time using stable source and subject identifiers. Pre-filter candidates before model context is assembled; do not rely on the model to ignore forbidden passages. Keep the policy decision, retrieved document identifiers and citations in the request record.
Design for deletion and change
Every chunk needs lineage back to a source version. A revoked permission, deleted file or retention event must propagate to the index within a defined service level. Test stale indexes, group changes and mixed-permission documents as explicit failure cases.
Evaluate the system, not only answers
Measure citation correctness, retrieval recall, permission leakage, abstention and freshness. Use adversarial tests that cross departments, roles and tenants. A useful acceptance set contains both answers the system should produce and documents it must never reveal.