That depends on the application's actual access controls, not simply on whether it uses RAG or a familiar model. Start with an approved workflow, a defined audience and the minimum information needed to help them.
Agree the data boundary List the source systems, user groups and excluded information. Decide which account reads each source and whether access is checked for the person asking. A search index, cached answer or conversation history must not silently bypass the intended boundary.
Ask for demonstrations of: - A permitted question with a valid source. - The same question from a person without access. - Revoked permissions and updated or deleted source material. - Missing or conflicting evidence and a useful fallback. - A document that contains instructions trying to redirect the assistant.
Treat these as a test plan for your configuration, not proof that every possible attack has been excluded. Processing location, providers, retention, logging and any required data-processing agreement must be assessed for the actual setup.
Wavect's internal AI assistant service covers scoped retrieval and pilots. A dedicated AI security review has a separately agreed boundary. Product development, a security assessment and legal approval are different responsibilities.
Share first: the type of documents, intended users, desired answer and information that must remain excluded. Do not upload confidential source documents to this chat; agree a suitable channel and permissions with the team.