Permissions and citations before a smarter prompt

A better prompt cannot correct an access model that gives an assistant the wrong documents. It also cannot make an unsupported answer auditable after the fact. Before polishing tone or adding agent behaviour, a production assistant needs two ordinary product capabilities: permission-aware access to sources and citations a user can inspect.

These controls are not optional enterprise decoration. Permissions determine what the system is allowed to know for this request. Citations show what evidence it actually used. Together they create a boundary for retrieval, review, correction, and accountability.

Reuse product identity instead of inventing AI access

The application should resolve the user, organisation, role, and resource scope before sending a query to retrieval. The AI layer receives filters or authorised source identifiers, not a universal document collection. If access changes in the source system, the index must update or enforce the source permission at query time.

Permissions need to follow the data through ingestion. Each chunk or record should preserve a stable source identifier, owner, tenant or organisation, access class, version, and deletion state where relevant. Flattening documents into anonymous vectors removes the information required to protect them later.

Tool permissions are separate from reading permissions. A user may be allowed to view a customer record but not change it; an assistant may draft an update but require confirmation before writing. Each tool should validate its own arguments and identity rather than trusting the model to remember policy.

A citation must help a person verify the answer

Displaying “[1]” is not enough. The citation should identify the document or record, link to the authorised source, and show the passage or context that supports the statement. If an answer combines several sources, the interface should make those relationships understandable instead of attaching every retrieved item to the bottom.

Citations also improve correction. A user can report that the source is outdated, the passage was misread, or the conclusion exceeded the evidence. The team can then distinguish a source problem, retrieval problem, and generation problem.

Prompt work comes after the evidence path

Prompts still matter. They define how the model uses context, handles conflicts, states uncertainty, and formats output. But prompt work should be evaluated against permission-filtered retrieval and inspectable sources. Otherwise a polished answer can hide the fact that it used the wrong evidence.

The practical order is identity, permissioned sources, retrieval, citations, evaluation, and then interaction refinement. A smarter prompt can improve an already controlled system. It cannot create the control by itself.