Document-level permissions
Retrieval is filtered by the identity of the person asking. Someone who cannot see a document in the source system cannot see it through the assistant either, and permissions are re-read from the source on every indexing run.

