The word private is not enough
Hosting an index in a controlled environment does not mean every processing step is controlled. Documents may pass through extraction, embedding, generation, logging and observability services.
The data map should cover the complete journey and each provider’s responsibilities.
Enforce source-system permissions
The retrieval layer must not expose a document to someone who could not access it in the source system. Authorisation filters must run before context is sent to the model.
- Separate public, internal and sensitive corpora
- Synchronise permissions and process revocation
- Cite sources and their update dates
- Define retention for queries, answers and logs
Prepare for errors and incidents
A plausible answer may still be wrong or based on an outdated document. Make sources available, signal uncertainty and provide a way to report problems.
Teams also need a kill switch, an incident procedure and regular access-control testing.