[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"guide-how-to-stop-an-ai-assistant-leaking-documents-people-cannot-open::en":3,"guide-related-how-to-stop-an-ai-assistant-leaking-documents-people-cannot-open::en":17},{"slug":4,"title":5,"excerpt":6,"body":7,"meta_title":5,"meta_description":8,"keywords":9,"category":15,"published_at":16,"updated_at":16},"how-to-stop-an-ai-assistant-leaking-documents-people-cannot-open","How to Stop an AI Assistant Leaking Documents People Cannot Open","The index was built by a service account that could read everything, so the assistant can quote anything it crawled. Nothing errors, and the leak is found when someone reads an answer meant for others.","\u003Ch2>The failure that never raises an error\u003C\u002Fh2>\n\u003Cp>An internal assistant is usually built the same way: point a crawler at the wiki, the drive, the ticket system and the code host, embed everything it finds, and put a chat box in front of it. The crawler runs as a service account with broad read access, because that is the only way to reach every source without a week of permission work. That single convenience decides the security posture of the whole system.\u003C\u002Fp>\n\u003Cp>What makes this dangerous is that it never announces itself. No request fails, no alert fires, and the assistant answers fluently and helpfully. The problem surfaces when somebody reads a response containing salary bands, an unannounced reorganisation or a legal matter they recognise as not theirs — and by then the same answer has probably been given to other people who did not mention it.\u003C\u002Fp>\n\u003Ch2>Why the index forgets who could read what\u003C\u002Fh2>\n\u003Cp>Permissions live on documents. Embeddings do not have documents; they have vectors, and a vector is a position in a space where the only surviving relationship is similarity. When content is chunked and embedded, everything the source system knew about ownership, sharing and group membership is discarded unless you deliberately carry it across.\u003C\u002Fp>\n\u003Cp>So the retrieval step answers the question which passages are closest to this query, and closeness has no opinion about whether the person asking was ever allowed to read them. The model then does exactly what it was built to do: it writes a good answer using the material it was handed.\u003C\u002Fp>\n\u003Ch2>Carry the labels into the index\u003C\u002Fh2>\n\u003Cp>The fix begins at indexing time. Every chunk should be stored with the access metadata of the document it came from — the groups, roles, tenant identifier or document ID that governs the original — as filterable fields alongside the vector. If your vector store cannot filter on metadata efficiently, that is a reason to change the store rather than a reason to skip the control.\u003C\u002Fp>\n\u003Cp>Attach classification too, where you have it. A tier that marks a record as restricted lets you enforce rules that are otherwise unenforceable, such as keeping the most sensitive material out of the index entirely, or allowing it to be retrieved but never sent to an external model.\u003C\u002Fp>\n\u003Ch2>Filter at query time, not after ranking\u003C\u002Fh2>\n\u003Cp>The query has to carry the identity of the person asking, and the filter has to be applied before results are ranked. Filtering afterwards is the common shortcut and it is wrong in two ways: it leaks information through result counts and timing, and it silently shrinks the result set, so a user with narrow access receives fewer and weaker passages instead of the best passages they are entitled to. That produces worse answers for exactly the people most likely to complain about them.\u003C\u002Fp>\n\u003Ch2>Keep the labels from going stale\u003C\u002Fh2>\n\u003Cp>An index is a copy, and permissions change constantly — a share revoked, a role changed, someone leaving. Re-indexing on every permission change is impractical, so most working systems re-check authorisation against the source system at answer time, but only for the handful of documents actually being used. That is affordable precisely because it is a handful, and it closes the window between a revocation and the next crawl.\u003C\u002Fp>\n\u003Ch2>Multi-tenant products need a harder line\u003C\u002Fh2>\n\u003Cp>If you are building this into a product rather than for one company, a filter mistake crosses a customer boundary instead of an internal one. Separate indexes or hard tenant partitions are worth the extra operational weight, because a single missing filter in a shared index is a cross-customer disclosure, and the query that exposes it can be completely innocent.\u003C\u002Fp>\n\u003Ch2>Test it like a permission system, not like a search engine\u003C\u002Fh2>\n\u003Cp>Build a small set of probe accounts with deliberately different access, and a fixed list of questions whose answers depend on documents only some of them can open. Run it on every change to the retrieval configuration and treat a leaked passage as a failing test rather than a quality issue.\u003C\u002Fp>\n\u003Cp>Log the document identifiers behind every answer as well. Retrieval logs are what let you determine, after the fact, exactly who was shown what — and if you cannot reconstruct that from the logs, you cannot scope an incident, which means you have to assume the widest possible exposure.\u003C\u002Fp>","An internal assistant inherits the crawler's access, not the reader's. Here is how to carry permissions into the index and enforce them at query time.",[10,11,12,13,14],"permission aware retrieval","rag security","internal ai assistant","access control","data classification","privacy-security","2026-08-24T03:30:02+00:00",[18,23,27,31,36,40],{"slug":19,"title":20,"excerpt":21,"updated_at":22},"ai-tool-pricing-models-seat-vs-usage-vs-credits","AI Tool Pricing Models: Seat-Based vs Usage-Based vs Credits","The three common ways AI tools charge — per seat, per usage, and by credits — and how to reason about which one will actually be cheaper for the way your team works.","2026-08-05T14:32:26+00:00",{"slug":24,"title":25,"excerpt":26,"updated_at":22},"how-ai-image-generators-differ-diffusion-vs-the-rest","How AI Image Generators Differ: Diffusion vs the Rest, in Plain Terms","A non-technical explanation of how AI image generators work, why the diffusion approach became dominant, and what practical differences to expect between tools.",{"slug":28,"title":29,"excerpt":30,"updated_at":22},"how-to-automate-your-workflow-without-code","How to Automate Your Workflow Without Code","A practical sequence for building automations that survive: picking the right process, mapping it before touching a tool, and handling the failure cases that break most first attempts.",{"slug":32,"title":33,"excerpt":34,"updated_at":35},"how-to-build-a-chatbot-without-coding","How to Build a Chatbot Without Coding","A practical route to a working chatbot using no-code tools: deciding scope, connecting your own content, handling the questions it cannot answer, and knowing what it will cost.","2026-08-05T14:32:27+00:00",{"slug":37,"title":38,"excerpt":39,"updated_at":16},"how-to-change-a-prompt-without-breaking-production","How to Change a Prompt Without Breaking Production","Prompts get edited in a text box and shipped in seconds, which is why they break things quietly: no compiler, no stack trace, no obvious moment of failure. Give them the release discipline code gets.",{"slug":41,"title":42,"excerpt":43,"updated_at":22},"how-to-choose-an-ai-writing-assistant","How to Choose an AI Writing Assistant","A practical framework for picking an AI writing tool — matching it to the kind of writing you actually do, checking editing controls, and avoiding tools that produce confident but generic copy."]