A 311 RAG assistant indexes an internal SharePoint library that includes HR investigation notes. What corpus-scoping control should security require first?

Excluding restricted HR collections from the 311 retrieval corpus is the correct first control because a retrieval-augmented assistant can only answer from what it can search. If SharePoint libraries that hold investigation notes are embedded into the citizen-facing index, similarity search can return those chunks into the prompt and surface personnel matters that 311 should never disclose. Corpus scoping at ingest and index time removes the data from the attack and mistake path before generation, citations, or model size debates begin.

Increasing temperature so the bot paraphrases investigation details fails by concept: temperature changes sampling randomness, not access control. Paraphrasing a restricted HR fact still leaks the fact to a resident. Disabling citation links fails because hiding the click-through does not stop the model from reading and restating retrieved investigation text in the answer body. Training a larger foundation model so retrieval is no longer needed fails because abandoning RAG does not authorize dumping HR into a public assistant’s knowledge path, and larger weights neither implement municipal ACL policy nor remove the need to keep restricted records out of citizen channels.

Exam caveat: On GAIPS-style items, prefer preventing retrieval of restricted civic corpora over cosmetic UI or decoding tricks. Corpus membership is an authorization decision for municipal knowledge systems.

Operational check: Inventory SharePoint sources feeding the 311 index, exclude HR investigation libraries from crawl and embed jobs, verify similarity search for investigation keywords returns no restricted chunks, and document the allowlist of public-safe collections for the assistant.