The short answer
- Preserve source identity, version and access metadata on every passage.
- Authorize retrieval before restricted content reaches the answer context.
- Test revoked access and deletion across indexes and caches.
Keep identity and document ownership attached
During ingestion, retain the source identifier, version and access metadata alongside each passage. A chunk without that context is difficult to invalidate or authorize later. Map the requester to the current permission context before searching. Do not assume that membership at ingestion time remains valid when the user asks a question days later.
Filter before constructing the answer
Apply eligibility checks before source passages enter the generation context. Hiding a citation after generation cannot remove information already expressed in the answer. If permissions cannot be represented reliably in the retrieval layer, narrow the initial source domain or use an additional authorization check before accepting any candidate passage.
Treat caches as another access surface
A cached answer can contain restricted knowledge even if the query is ordinary. Include the relevant permission context and source version in cache decisions, or avoid sharing answer caches across audiences. Revoked access and document deletion need an invalidation path that reaches derived indexes, cached passages and generated answers retained for reuse.
Test changes, not just the initial state
Create evaluation cases for a user losing access, a policy being replaced and a document being deleted. Verify that citations still open only for eligible users and that the assistant declines unsupported questions. Record the source versions used for an answer so an investigation can explain what evidence was available at the time without retaining unnecessary private content.
Apply this to your project.
Bring the current workflow and the part you are unsure about. We can help define the next useful engineering decision.
Explore the relevant service