Why the check must happen before the assistant reads anything

Updated November 2026 · About 5 minutes to read · Video, about four and a half minutes

Why the check must come first, in about four and a half minutes. Captions are on; the CC button turns them off. Watch on YouTube.

The short answer

An AI assistant on your documents looks things up first, then writes its answer from what it found.

If it checks who is asking before it looks, it can only ever find what that person may see. If it looks first and checks afterwards, restricted text has already been read, and it can slip into the answer.

Think of a receptionist at a records room

You ask for a file. A good receptionist checks your badge, then fetches only the files you're cleared for.

Now picture one who pulls every matching file, reads them all, and only then asks for your badge. Even if they hand you only your files, they've read the others, and what they tell you can be shaped by them.

Where the picture stops working: an assistant can blend passages from many files into one answer, so the check has to happen for every passage, not once at the door.

Two ways to check

When someone asks a question, the assistant searches its catalogs for the passages that best match. Engineers call this step retrieval. The check can sit in one of two places.

Check first

The search itself only covers passages this person may see. Engineers call it pre-filtering, or permission-aware retrieval.

Gives you: what was never read can't leak, and the best answer comes from what they're allowed to see.

Check afterwards

The search covers everything, and restricted passages are removed from the results later. That's called post-filtering.

Gives up: safety depends on every later step catching every restricted passage, every time.

Both can look the same in a demonstration. The difference shows up in what can go wrong.

How a well-built system does it

The rules travel with the text. Each document's access rules are copied in alongside it, attached to every passage, and kept current when they change. How the assistant knows who may see each document.
The search knows who is asking. It uses the person's identity and groups to limit the search before anything is read.
Some things never share a catalog. Where departments or clients must never mix, documents can live in separate catalogs altogether.
Built-in assistants follow your existing permissions. Microsoft, for example, says Microsoft 365 Copilot only surfaces data people already have at least view permission for (Microsoft Learn). That's only as safe as those permissions are today.

What goes wrong when the check comes afterwards

One gap is enough. A step that forgets to filter, or a new feature that skips it, and restricted text reaches the answer.
The leak isn't always a quote. A summary, a hint, or a source link can give away what's in a file the person couldn't open.
Thinner answers, with no explanation. If the best matches were restricted and then removed, people get weaker answers and don't know why.

Why security teams care

The OWASP security foundation lists weak access controls in these search systems among its top ten risks for AI applications, because they can expose sensitive data, including between users who share one system (OWASP, LLM08:2025).

Questions to ask your IT team or vendor

Does it check who is asking before it searches, or does it remove restricted results afterwards?
Is the check applied to every passage, including summaries and source links?
When someone's access changes, or a file's sharing changes, how quickly does the assistant know?
Can we see it tested: two people from different departments asking the same question, and each getting only what they may see?

Other names you may hear

Retrieval: The step where the assistant searches your documents for passages that match the question.
Pre-filtering, permission-aware retrieval: Checking who may see what as part of the search itself.
Post-filtering: Searching everything, then removing restricted results.
Security trimming, document-level security: Product names for hiding results a person isn't allowed to see.
RAG: Retrieval-augmented generation: the assistant looks things up in your documents, then writes the answer. How it works, at EnterpriseLLM.ai.