The best passage belongs to another customer. Now what?
Design the retrieval and answer path. What should the user see?
“users can only query tables they already have permission to access.” (opens the source)
The question
KestrelOps answers a technician at North Works. Retrieval found three passages for a conveyor reset. The authorization service supplies the user’s tenant and document permissions before retrieval. A similarity score is relevance evidence, not an access decision.
| Tenant | Version | Similarity | Permitted | |
|---|---|---|---|---|
| A: reset procedure | South Works | Current | 0.96 | No |
| B: reset procedure | North Works | Retired | 0.91 | Yes |
| C: fault overview | North Works | Current | 0.79 | Yes |
The current North Works reset procedure is absent from this result.
Use only permitted, current reset instructions. If they are absent, do not invent reset steps. Offer an authorized escalation path.
“Design the retrieval and answer path. What should the user see?”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: Enforce access before ranking
What would you do here? Open the move you’d make.
Pass A to the model and tell it not to quote it.
Tempting, but it misses something. The forbidden content has already crossed the boundary if it reaches the model.
Filter by server-verified permissions before relevance ranking.
The strong move. The model prompt is not an authorization boundary.
See how a strong candidate says it
“Tenant and document permissions must constrain retrieval on the server. A is unavailable to this user, regardless of its similarity score.”
Why it works: The model prompt is not an authorization boundary.
Step 2: Check freshness separately
What would you do here? Open the move you’d make.
Use B because the user may access it.
Tempting, but it misses something. Access permission does not make an obsolete procedure valid.
Reject B as reset evidence despite its valid access.
The strong move. Authorization and currency are separate checks.
See how a strong candidate says it
“B is permitted but retired. I would query current North Works documentation with version metadata and inspect whether indexing or permissions caused the gap.”
Why it works: Authorization and currency are separate checks.
Step 3: Give a bounded answer
What would you do here? Open the move you’d make.
Blend A and B into an unquoted answer.
Tempting, but it misses something. Paraphrasing forbidden or retired instructions does not fix the evidence.
Explain the evidence gap and offer the authorized escalation.
The strong move. An abstention can still move the user to a useful next step.
See how a strong candidate says it
“I can explain the fault overview from C, but I cannot give a verified reset procedure. I would link the current-document request or an authorized technician.”
Why it works: An abstention can still move the user to a useful next step.
Step 4: Test the boundary
What would you do here? Open the move you’d make.
Test only citation formatting.
Tempting, but it misses something. A well-formatted citation can expose the wrong tenant’s data.
Add cross-tenant, revoked-access, and retired-version cases.
The strong move. The release check must cover both access enforcement and answer behavior.
See how a strong candidate says it
“I would test retrieval and the final answer with cross-tenant matches, revoked permissions, cache reuse across users, and retired versions.”
Why it works: The release check must cover both access enforcement and answer behavior.
The answer, in short
- Decision
- Withhold the reset steps until permitted current evidence is available.
- Because
- None of the retrieved passages satisfies both the reset-task and evidence rules.
- What would change it
- An authorized current North Works procedure could support a cited answer.
How would you prevent a shared retrieval cache from bypassing revocation?
Common traps
- Confusing similarity with permission.
- Applying access rules only after generation.
Check your answer
- Did I keep access checks server-side?
- Did I check document version?
- Did I avoid leaking forbidden material?
- Did I give an authorized next step?
Last reviewed Nov 10, 2026