Do your AI features use retrieval-augmented generation (RAG), and how are access controls enforced on retrieved content?

If your product retrieves internal content to ground AI responses, explain that retrieval is scoped to documents the requesting user is already authorized to access, with permissions enforced at query time rather than copied into a separate index that can drift. Confirm that tenant isolation applies to embeddings and vector stores exactly as it does to source data.