A document processed by an AI assistant includes instructions to reveal another user's records. Which design best limits the impact?

1. Rely only on asking the model to ignore malicious text
2. Treat retrieved text as untrusted and enforce authorization outside the model
3. Allow source documents to define the assistant's access permissions
4. Give the assistant a global administrator token to simplify retrieval