Unverified50% confidenceDecision RuleExact time
Before retrieval, documents the user has no permission to view should be filtered out based on the user's access control list; writing "do not mention confidential documents" in the prompt does not constitute access control.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedTenant and permission filtering must be enforced within the retrieval query itself rather than relying on natural language prompts; using prompts for access control is not real access control.74% similarUnverifiedFor public filings, the document text itself has close to zero privacy requirements, but query patterns (which companies, when they are analyzed) may still be sensitive, and query pattern management should be considered separately from the document hosting strategy.73% similarUnverifiedPermission-aware retrieval usually works by tagging each chunk with access control labels and filtering by user identity at the retrieval stage, rather than retrieving first and blocking afterwards.71% similarUnverifiedCowork enforces extremely strict file access controls; if a file is not in an authorized folder, it can be seen even when dragged into the conversation but cannot be read.71% similarUnverified检索系统可能因权限设计或上下文过滤不当将信息暴露给未授权用户，该问题必须在设计阶段验证而非等安全事件发生后补救。70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1044241API
curl https://kongchang.com/api/v1/knowledge/claims/1044241MCP
get_claim(id=1044241)