Private Knowledge and Retrieval

Let an AI find useful documents while keeping ownership, citations, freshness, and deletion rules intact.

Content date: October 15, 2026.

Plain English

Retrieval picks the source material a model reads before it answers. Search relevance and access control solve different problems, and a relevant document may still be off limits. First work out who the signed-in user is and what they may see. Then pick material, and check every source before it enters the model's context. A citation points to evidence, but it doesn't prove the answer actually follows that evidence.

Use this when

Do this when you add document Q&A, internal search, a support knowledge base, or recommendations that depend on a customer's own data.

If you are just starting

Use a tiny set of made-up documents with two owners and clear document IDs. Start with ordinary keyword search if it fits the task. Embeddings (a way to search by meaning instead of exact words) aren't required. When the allowed sources don't support an answer, return an "insufficient evidence" message instead of letting the model invent one.

When your project grows

Enforce permissions in the retrieval service itself, because a prompt or a tenant filter sent by the browser can't be trusted. Match indexes and caches to the same boundaries, such as one filter per customer, and set that filter from the signed-in user on the server. Track document versions, and check that edits, revoked access, and deletions reach storage, indexes, caches, and kept logs. Treat instructions inside retrieved documents as untrusted content.

Worked example

Two made-up customers, Brightside Dental and Harbor Law, each have a document titled Pricing. A question from Brightside must never retrieve Harbor Law's file, even if Harbor's text matches the question better. After Brightside deletes its Pricing document, asking the same question again must not return a cached quote from it.

Practice

Prove private retrieval stays private

  1. Create two made-up customers with documents that share titles but have different contents.
  2. Sign in as one customer and retrieve only that customer's documents.
  3. Try a forged tenant filter and another customer's document ID directly, and record that both are denied.
  4. Check each answer against its cited source, and handle a question the documents can't answer.
  5. Update, revoke, and delete a source, and test both search and cached answers after each change.

Deliverable: A working demo where each user sees only their own documents, plus a test table covering cross-customer access, unanswerable questions, freshness, and deletion.

Common mistakes to watch for

  • A search box trusts a tenant filter from the browser, and one customer reads another's contracts.
  • A shared cache returns one account's private answer to another account.
  • A deleted document keeps appearing in results because the index was never updated.
  • An answer cites a real document that doesn't say what the answer claims.

Prompting

A weak prompt

Search all customer documents and let the model decide what each user can see.

A better prompt

Build a small question-and-answer demo over made-up documents for two customers. Work out the permitted documents from the signed-in user before searching. Return citations with document versions, and say "insufficient evidence" when the sources don't answer the question. Test another customer's document ID, a forged tenant filter, empty results, revoked access, deletion, stale caches, and documents that contain instructions. Don't use real customer records.

You can see and test who may retrieve what while the data set is still small enough to understand.

Check before you move on

  • The server works out who the user is.
  • Only authorized sources reach the model.
  • You checked each citation supports its claim.
  • The app has an "insufficient evidence" answer.
  • Caches are separated per customer.
  • Revoked access and deleted documents disappear from results.

You are done when

  • In every path you tested, another customer's data never enters the model's context.
  • Each answer cites a permitted, current source or says there isn't enough evidence.

Questions to think about

Can a prompt line like "never reveal other customers' documents" replace access checks?

No. If the model can see another customer's document, a clever question or hidden instruction can pull it out. Keep unauthorized documents out of its context.

An answer cites a real document. Does that mean the answer is supported?

No. The cited passage must say what the answer claims, and the source must be current and permitted. A link alone doesn't show that.

You deleted the document row, but users still see the old answer. Is the deletion finished?

No. Copies can live on in indexes, caches, and logs. Trace each one, follow your retention policy, and check what users actually see.

Official references