One reused retrieval call showed a customer a stranger's address

transcript

A customer asks the assistant about a return. The answer includes another customer's address. How? One reused retrieval call.

Support agents get a new panel. Similar resolved tickets. Staff only. A developer reuses its retrieval call, in the customer assistant. But the call runs with the console's permissions. Not the customer's. So a customer sees another customer's ticket, with their home address.

Slack and Microsoft say it almost the same way. Retrieval runs as the user. The assistant has no permissions of its own.

Every query carries the end user's identity. A customer retrieves only their own tickets. Support staff can see other tickets, but only PII-scrubbed summaries. Entitlements down? Fail closed. Public content only.

Make the retrieval client refuse to run without the user's identity. Purge any cached answers that quoted the ticket. And treat it as a breach.

Not after the top 20. A prompt isn't access control either. Inside the search, as the user.

Full breakdown in the lecture.