Use a control-plane/data-plane separation with authorization enforced before evidence reaches the generation layer. Architecture: Identity → Policy Engine → Tenant-Aware Retrieval Router → Authorized Retrieval → Evidence Validation → Context Assembly → LLM → Output Validation → Audit Tenant isolation: Every request carries tenant_id, principal_id, roles, permissions, and resource scope. Authorization is evaluated independently from retrieval relevance. Retrieval contract: The router applies tenant and authorization filters before candidate retrieval, then performs ranking and evidence validation. Provenance: Each context item retains source, document, chunk, retrieval, and policy metadata. Context boundary: Retrieved documents are treated as untrusted evidence and cannot override system policies. Audit: Record policy decisions, retrieval route, source identifiers, validation status, and request identifiers while avoiding unnecessary sensitive-content logging. The design prevents a relevant document from being returned when the requesting principal is not authorized to access it.