Module 6 · Lesson 2 of 3
Keeping each customer's data apart
Where the permission check runs
In a shared index, a filter on the owner inside the search keeps other customers' text out of the prompt and keeps every result useful.
Scene 1 of 5 · One index, two companies
Acme and Globex keep their documents in one index, used by the same help assistant.
- Acme user — healthy
- Your app — healthy
- Shared index — two companies — healthy — Acme and Globex
- Language model — healthy
| Chunk | Score | Where it went |
|---|---|---|
| Globex: 22% off | 0.91 | – |
| Acme: 15% off | 0.88 | – |
| Globex: ends in June | 0.84 | – |
| Acme: yearly review | 0.80 | – |
| Acme: needs sign-off | 0.71 | – |
- One index, two companies. Acme and Globex keep their documents in one index, used by the same help assistant.
- An Acme user asks. A user at Acme asks which discount was agreed with "our biggest client".
- Meaning ignores owners. With no check, the closest match is a Globex contract, and it heads the list.
- Filter inside the search. With the company as a filter in the query, only Acme chunks are ranked at all.
- Only allowed text travels. Three Acme chunks reach the prompt, and no Globex text is sent to the model.
- Now you try. Pick where the permission check runs, and see what reaches the prompt. For example: The same 2 Globex chunks reach the prompt; only a sentence asks the model to ignore them. The text already went to the model, and a well-aimed question or a hidden line can draw it out.
Scene 1 of 5: One index, two companies. Acme and Globex keep their documents in one index, used by the same help assistant.
Key points
- Meaning search ranks by closeness and ignores who owns each chunk.
- An instruction in the prompt comes too late: the text is already there.
- Filtering after the search is safe, but can leave too few results.
- Filtering inside the search is safe and keeps every place for allowed chunks.
Many AI features search one (An extra structure, kept sorted or grouped, that lets a database find matching items without reading all of them.) that holds documents from many customers or teams. The search ranks by meaning, and meaning knows nothing about who may read what.
So the permission check belongs inside the search. Each (A short passage cut from a longer document, so it can be turned into an embedding and found on its own.) records its owner, and the query filters on the user's rights before anything is ranked.
An instruction such as "use only this user's documents" is not a boundary. Once the text is in the (Everything sent to a language model in one request: instructions, context and the question.), a clever question or a planted line can bring it out.
Everything in the prompt also goes to the model provider. Check how long the provider keeps it and whether it trains on it, and send only the personal data the answer needs.
In system design: Store the owner on every chunk, filter by the user's rights inside the search, and log which chunks each answer used.