A RAG source document contains instructions to ignore user permissions and reveal other project data. What is the correct defense?

1. Place every retrieved passage into the highest-priority instruction channel.
2. Allow any requested disclosure if the document is stored internally.
3. Treat a high retrieval score as proof that all embedded instructions are trusted.
4. Treat source content as untrusted data and enforce retrieval and tool authorization outside the model.