Embedding documents in a search index does not remove confidentiality obligations or prevent a chatbot from retrieving somebody else’s records.
Similarity is not authorization
A vector index returns items that resemble a search query. It does not automatically know whether the requester may view the source document. If multiple users share one index, a relevant chunk from an HR file, customer complaint or executive memo might be retrieved for the wrong person. The application must enforce identity and document-level authorization independently of semantic similarity.
Where permissions can be lost
A source folder may have access controls that disappear when files are copied into ingestion storage. Chunking may strip ownership metadata; a reindex operation may omit a tenant identifier; a cache may serve a response after permissions change. Deleting an original document does not guarantee that copies, embeddings, logs or cached answers disappear. Map the entire path before making privacy commitments.
Defensive design
Apply access checks before retrieval or at a trusted filter that cannot be chosen by the model. Preserve tenant, owner, classification and expiration metadata; maintain revocation and deletion workflows. Encrypt stored indexes and protect service credentials. Use constrained queries and audit unauthorized-access attempts without storing entire private responses unnecessarily. Review cross-tenant and shared-link handling in isolation.
Injection still matters
Even authorized retrieved documents can contain hostile text that instructs the assistant to ignore policy or reveal other materials. Tag retrieved passages as data, not instructions. Prevent retrieved content from authorizing tool calls or modifying permissions. OWASP’s 2025 vector and embedding risk guidance discusses unauthorized access and manipulation; a vector database is not a prompt-injection defense.
A safe test suite
Use deliberately planted canary strings in controlled test documents with known access policies. Query as users from different roles and tenants, checking both retrieval hits and final answers. Test changes to permissions, deletion, bulk exports and cache invalidation. Do not conduct these tests against real coworkers’ private information without explicit authorization.
Worked example
A support agent can open one client’s account notes, while a manager can open all clients’ notes. If both use the same search assistant, the agent’s query must never retrieve the manager-only collection, even when the query wording is identical. The authorization layer—not a prompt reminding the model to be discreet—must enforce the difference.
Residual risk
Embeddings can reflect sensitive source information, and downstream model outputs can leak retrieved passages. Access logs and endpoint protection must be scoped to the actual system and geography. Product-specific storage, data residency and encryption promises need separately dated supplier documents; no universal vendor assurance is implied.
Sources & Further Reading
Primary Scope and applicability vary by task and jurisdiction. This article is educational guidance, not legal, medical or financial advice.