A legal-research assistant serves attorneys at a firm with strict ethical walls: attorneys on one matter must not see documents from conflicting matters. All documents sit in one vector index, and the assistant retrieves the top chunks and then instructs the model to ignore any chunk from a matter the user isn't staffed on. An audit finds conflicting-matter text in some answers. What is the root cause and fix?

Answer: D — Authorization is left to the model after retrieval; apply the user's matter entitlements as a filter in the query

Restricted chunks reach the context and the model is acting as the access-control mechanism, which can't be relied on. Apply the user's entitlements as a filter in the retrieval query (or separate indexes where isolation demands it) so unauthorized content is never returned. (a) keeps prompt-based enforcement. (c) shrinks the leak without closing it. (b) is a compensating control after the restricted content has already influenced the answer.