ORIGINAL COMPANY-CONTEXT PRACTICE
Retrieve authorized passages from a synthetic research library
Original practice scenario: Design a research assistant over fictional analyst documents with different client entitlements and frequent revisions.
Written for independent practice using company context; this is not a verified question from a company interview.
A REASONED APPROACH
Model answer.
Authorization belongs in retrieval and evidence handling, not merely in the final prompt. A fluent answer is unacceptable if it uses a passage the requesting user cannot access.
Work through it
- Attach document version, publication time and access metadata during ingestion; enforce the user's current entitlement before returning candidate chunks.
- Evaluate retrieval and citation support with synthetic questions, conflicting versions and no-answer cases; prefer current authorized evidence under a documented policy.
- Recheck permissions when opening cited material, record access-safe diagnostics and test revoked access, malicious document instructions and expired sessions.
Tradeoffs to discuss
- Filtering before search protects boundaries but can reduce recall; overfetching must still prevent unauthorized text from reaching the model or logs.
Common pitfalls
- Do not assume a citation proves that every generated sentence is supported.
- Never place real client documents into the practice dataset.