A team will send internal documents to a hosted AI service for retrieval. Which two checks directly reduce unintended disclosure? Select 2 answers.

1. Verify service retention and training-use terms against approved data handling
2. Enforce document-level authorization before returning retrieved context
3. Assume vector embeddings are always anonymous
4. Give every user access to one shared unrestricted document index