A RAG assistant retrieves confidential HR documents for non-HR users. Where should the primary authorization control apply?

1. Only in the final answer's formatting template
2. After sending every retrieved chunk to the external model
3. During retrieval so unauthorized chunks never enter the generation context
4. Only in a prompt asking the model to be discreet