Why permissions belong in front of the model, not in the prompt

An AI assistant should never know more than the person asking it. That sounds obvious. Yet the first knowledge search in many companies looks like this: every document goes into one shared index, and the prompt carries a line such as “Do not reveal confidential content”.

The model then sees the board minutes, the salary list and the price list alike. It is merely asked to keep quiet about some of them.

1. 1A language model can be talked into things. Cleverly worded questions, or instructions hidden inside a document, can make it repeat what it has read. These attacks are called prompt injection; the OWASP GenAI Security Project ranks them first in its list of the top risks for applications built on language models, with the disclosure of sensitive information second.
2. 2Summaries inherit the confidentiality of their sources. Whoever sees the summary of the board minutes has, in substance, seen the minutes, even if the document itself was never shown.
3. 3When it matters, you need to prove who saw what. An instruction in the prompt leaves no record of which documents the model has read.

What is reliable is a decision taken before the model sees anything. A fixed decision function checks identity, role, department and tenant for every request and determines which sources are searched at all. The others are never searched, not merely hidden.

Every hit is checked against the rule once more before it is handed to the model: a pre-filter in the search, a re-check of every candidate. When in doubt, the rule refuses. This can be built with proven means, for example row-level security in PostgreSQL, a policy engine such as Open Policy Agent and an interface following the OpenID Foundation's AuthZEN draft.

It also matters whose permissions count. An agent searching on behalf of a person may only work with knowledge that both the person and the agent are allowed to see.

An assistant constantly produces new material: summaries, entries in its memory, handovers to other agents. Classic access control decides who may open a document. It does not decide who may see what is made from it.

The rule for this is simple: derived material inherits the classification of its sources and never becomes a source of authority itself. A summary is as confidential as the most confidential document it was made from.

Every decision of the rule is logged: who asked, which sources were allowed and which were blocked. Kept as a chain with Merkle proofs following RFC 9162, the log can later be checked to show that no entry was changed or removed after the fact.

So when it matters, you can prove which request reached which documents, instead of having to trust the behaviour of a model.

Permissions first, then the code. The project starts with a written permission concept: who may see which sources, and which permissions are taken over from your existing systems. Only then is the search built.

I have written the approach up as a draft standard: AKAC, Agent Knowledge Access Control. It describes what AI agents in a company may know, derive, store and pass on.