Retrieval that respects who is asking
Most internal assistants leak. We tested ours against that.
What we found
Across [n] adversarial prompts designed to surface documents the user could not open, the assistant returned zero restricted passages.
An assistant over internal documents inherits a problem the documents already had: not everyone is allowed to read everything. Salary bands, contracts, board material and HR cases sit in the same drives as the harmless material.
The naive build indexes everything and hopes the prompt keeps it in line. It will not — that is a filter on generation, not on access.
We enforce permissions at retrieval instead: the query runs against the slice of the index the person asking is entitled to, so restricted material is never a candidate in the first place.
Then we tried to break it, with prompts written to trick it into quoting things it should not have. That test belongs in the hand-over pack, so the client can re-run it after their own changes.
Draft — re-run and replace [bracketed] figures before publishing (lib/lab.ts)