THE STARTING POINT
Three things to get right.
- Authorize retrieval against the requesting identity.
- Use synthetic data when evaluating prompts and tool behavior.
- Review where prompts, responses, and traces are stored.
TRY THIS IN THE LAB
A question worth testing.
Create two synthetic document collections with different access groups. Confirm the assistant cannot retrieve one group’s content for a user in the other.
Browse the lab notesLeave a useful trail.
Write down your starting assumptions, scope, expected behavior, observed behavior, and evidence. A successful test should explain what happened and which question to investigate next.