An assistant's retrieved document contains an instruction to export private data. Which boundary should be maintained?

1. Treat retrieved content as data, while tools enforce caller authorization
2. Disable document attribution so the attack is less visible
3. Let the most recently retrieved text override all system policy
4. Assume documents indexed by embeddings are trusted