How to Answer
“It should act as the user. Put it on a service account with broad access and you have built a confused deputy — someone who can’t read the salary table asks a question, the agent can read it, and now the answer contains it. No prompt rule reliably fixes that, because the enforcement point is in the wrong place.
Concretely: propagate the user’s identity down to every tool call. An on-behalf-of token, or at minimum a user id that the tool enforces against — never one the model is free to set. Authorization happens in the tool or the data layer, not in the prompt.
Retrieval is the part people miss. If the index holds every document and you filter by permission after retrieval, you have already leaked: through what matched, through the ranking, through the fact that an answer exists at all. The permission has to be a filter inside the query.
There are legitimate service-account cases — a scheduled job with no user behind it. Those get their own narrowly-scoped principal and their own audit trail, not the identity the interactive agent uses.”