A public library kiosk hosts an ordinance FAQ bot. Which retrieval rule best enforces data classification?

Classification-aware retrieval for a public library ordinance FAQ bot means the vector search path enforces document labels so the kiosk consumer cannot retrieve internal-only drafts or sealed legal memos. Public kiosks are untrusted relative to staff systems: they sit in open spaces, serve anonymous patrons, and must be limited to public-labeled corpus slices. Blocking retrieval of internal-only documents during search prevents the bot from grounding answers on non-public text even if those chunks would be semantically relevant. Labels stay on the corpus, and the retrieval ACL or metadata filter binds the kiosk identity to public content only—preserving municipal classification policy in the RAG path, not only in file shares.

Blocking internal-only passages with a post-generation safety classifier before display fails confidentiality and classification. Once internal chunks are retrieved into the kiosk's context, a post-generation safety classifier cannot guarantee they won't influence the answer or leak, and completeness for a public FAQ is limited to published ordinances, not attorney work product or pre-decisional drafts. Enforcing classification with kiosk-scoped metadata filters during final reranking fails because initial vector search happens before reranking; internal chunks can already enter the kiosk's context and shape the answer, so a rerank-time check misses every retrieval that occurs first. Encrypting internal-only vectors at rest with isolated keys for kiosk-time decryption fails because encryption at rest does not stop retrieval; if the kiosk can decrypt the internal vectors at query time, an anonymous session can still pull internal-only content into context.

Exam caveat: Classification enforcement at retrieval must bind the consuming identity's permissions to the label, not post-generation safety classifiers, reranking-stage metadata filters, or encryption at rest with kiosk-time decryption. If the account can technically reach it, an anonymous kiosk session eventually will. Also do not confuse "the model refuses" with retrieval controls—if forbidden chunks are retrieved into context, refusal alone is a weak last line of defense.

Operational check: Verify kiosk service principals or API keys are scoped to public-labeled collections only; test that internal-only ordinance drafts never appear in retrieved context regardless of query wording; keep labels on documents rather than stripping them; separate public and internal indexes or apply hard metadata filters; and review library bot answers after any corpus update for accidental internal content.