Opening a citation is another access check
Search permissions do not automatically protect a saved answer or its source preview. Review every place where citation evidence can be read or shared.
Read articleCobnex blogs / Global
Cobnex blog
AI implementation, software architecture and cloud operations for teams worldwide.
146 articles in AI engineering
Page 6 of 9
Deletion must reach diagnostic copies too
Extracted text often spreads into logs, queues and support records. A removal plan needs to account for those copies as well as the search index.
Read articleCheck destinations as well as the requested operation
An allowed export operation can still send the wrong data to the wrong place. Review destination resolution, redirects and payload scope together.
Read articleSeparate read authority from mutation authority
An assistant may be allowed to inspect a record without being allowed to change it. Preserve that distinction in tools, service identities and approval rules.
Read articleWho may approve this particular mutation?
An approver role is often too broad on its own. Check the target, operation, organisational scope and any separation-of-duties rule for the actual proposal.
Read articleRecheck the identity behind a resumed task
A durable run can outlive a login session, team membership or service permission. Decide which authority must still exist before the next action executes.
Read articleKeep sensitive examples out of unnecessary review systems
Evaluation data can spread into model prompts, dashboards and downloaded reports. Use the smallest evidence package that preserves the failure being tested.
Read articleReview new model destinations and retained payloads
A model migration can change where prompts, files and traces are processed. Review the actual data path and configuration before treating it as a like-for-like replacement.
Read articleProtect the original invoice as well as the extracted JSON
Document processing creates several representations of the same information. Apply access and retention rules to the source, page images, extracted fields and review history.
Read articleProvider support access belongs in the boundary review
Review who can inspect service data during normal operations and support incidents. Network isolation does not answer that question by itself.
Read articleWho may increase an agent's spending limit?
Budget changes are privileged operations. Scope them to the task and organisation, and keep them separate from the agent's own plan for continuing work.
Read articleA lack of authority is not a lack of confidence
Access decisions belong to the application. A model's certainty about an answer must not determine whether the user is allowed to receive its evidence or trigger an action.
Read articleThe hidden cost of permission-specific caches
Caching can reduce search and model costs, but protected answers cannot be shared just because the question text matches. Model the access boundary before choosing the cache key.
Read articleDoes the reranker earn its latency?
A second ranking stage should improve the passages people use. Measure its contribution separately from the cost of retrieving more candidates.
Read articleHow much neighbouring context is enough?
Adding nearby text can repair an incomplete passage, but it can also add duplication and conflicting material. Measure the information gained rather than choosing the largest context window available.
Read articleThe review cost of claim-level evidence
Citation checking adds retrieval, evaluation and human review work. Spend that effort where an unsupported claim would change a decision.
Read articleRefresh urgent policies more often than reference material
One refresh schedule rarely suits an entire knowledge base. Spend processing capacity according to how often information changes and what a stale answer would cost.
Read articleBudget adversarial runs before they become expensive loops
Injection testing needs repeatable attempts and clear stopping rules. Bound model calls, tool work and test data so failures remain affordable to investigate.
Read article