I have been contemplating how to properly permission agents, chat bots, RAG pipelines to ensure only permitted context is evaluated by tools when fulfilling requests. How are people handling this?

I am thinking about anything from safeguarding against illegal queries depending on role, to ensuring role inappropriate content is not present in the context at inference time.

For example, a customer interacting with a tool would only have access to certain information vs a customer support agent or other employee. Documents which otherwise have access restrictions are now represented as chunked vectors and stored elsewhere which may not reflect the original document's access or role based permissions. RAG pipelines may have far greater access to data sources than the user is authorized to query.

Is this done with safeguarding system prompts, filtering the context at the time of the request?