A SQL-backed RAG application serves several tenants. Where must the caller's data boundary be enforced?

1. Only by hiding the table name in the UI
2. Only by asking the model not to reveal forbidden rows after retrieving them
3. By treating semantic rank as user permission
4. During authorized retrieval before source data enters generation