A permission wall for sensitive company knowledge must act before retrieval, not after generation. It authenticates the caller, resolves the entity and purpose, limits eligible sources, and distinguishes reading from acting. The model never receives material outside that boundary, and text inside a prompt cannot promote the caller to a more privileged identity.
Describe access as a policy decision
Begin with trusted identity from the application or control plane. Do not accept a role, customer name, or admin claim supplied in conversational text. Bind the session to an authenticated actor, tenant or legal entity, assigned roles, and the current authorization version.
Classify knowledge by entity, sensitivity, domain, owner, and allowed purpose. Public marketing facts, ordinary internal procedures, customer-confidential records, finance data, personnel information, and restricted legal material should not share one undifferentiated index. Classification belongs to the source and policy layer.
Define operations separately. Permission to discover that a source exists is different from reading its content. Reading differs from exporting, summarizing across entities, updating a record, or triggering an external action. Least privilege gives the assistant only the operation required for the declared job.
The architecture discussed in company memory beyond vector search provides relevant public context for governed retrieval. It does not certify any client security posture.
Enforce the wall before candidates are read
The request enters a deterministic policy decision with authenticated identity, entity, purpose, operation, and requested sensitivity. The result is an allowed source profile or a denial. Retrieval runs only across that profile. Filtering the final answer is not sufficient because restricted text may already influence generation or logs.
Keep entity walls explicit. A service provider supporting several clients should not place their live mutable knowledge in one broadly searchable context. Cross-entity material must be separately sanitized and approved for that purpose. Similar wording is never a reason to cross the boundary.
When the policy denies access, return a minimal reason code and safe next step without confirming sensitive details. Record a denial receipt with actor, policy version, requested operation, decision, and time. The receipt supports audit without copying the protected content.
The verified completion memory release documents public mechanisms for retained evidence. It does not prove that a separate application has implemented correct identity or authorization.
Attack the boundary and verify final behavior
Test a contractor asking a general question that resembles a restricted finance topic. Add attempts to claim admin status, request hidden instructions, change the entity inside the prompt, combine harmless queries to infer a secret, retrieve by an exact leaked identifier, and use a write tool after read-only access.
Verify that unauthorized candidates are absent before generation, denial does not leak titles or snippets, logs stay within policy, and cached data is isolated and expires. Test role revocation during an active session and a source whose classification becomes more restrictive.
Measure cross-boundary retrieval in adversarial cases, policy-decision accuracy against approved fixtures, denial evidence, stale-session rejection, and independent confirmation that prohibited actions did not occur. A claim of zero exposure requires the named test scope and results; it must not be generalized to perfect security.
Retest whenever a role, data source, connector, tool, cache, or policy version changes.
Keep the approved fixtures independent from the generation prompt and review them after each incident.
Business-context retrieval in Unlimited Skills is public evidence of maintained tooling. Each deployment still needs its own identity provider, source profiles, threat model, and review.
Frequently Asked Questions
Security and knowledge owners jointly define the boundary and sign off on the residual access risk for the tested configuration.
Store the authenticated identity, entity boundary, sensitivity, purpose, requested operation, policy version, decision, and audit event. This receipt should explain the denial without exposing protected content.
If restricted text reaches the model before filtering, it can already influence the answer or logs. The policy must remove ineligible sources before any protected content is read.
Named adversarial tests should show no cross-boundary retrieval, no leakage through denials or logs, rejection of stale sessions, isolated caches, and independent confirmation that prohibited actions did not occur.
AI4SALE has built bounded retrieval and source-backed memory mechanisms and publishes their contracts, without claiming universal security certification. Teams can use the exact planned AI4SALE enterprise AI search service after its publication gate to design the pre-retrieval wall and adversarial acceptance tests.