The common architecture for an enterprise assistant is to index the organisation's documents into a vector store and retrieve against them at query time. The failure mode is immediate and severe: the index has no notion of who may read what, so the assistant will happily summarise a document the asking user could not open in the system it came from.
This is not a content-filtering problem and it cannot be solved by instructing the model. It is an access control problem, and it has to be solved where access control is already solved — at retrieval, under the identity of the user asking.
In practice that means the retrieval layer carries the user's effective permissions into the query, the index stores the access control metadata alongside each chunk, and permission changes in the source system propagate to the index on a defined and monitored interval. Where the source system's permission model is itself complex, that complexity has to be reproduced rather than approximated. It is a substantial amount of engineering, it is the part of the work that determines whether the assistant can be deployed at all, and it is routinely underestimated at proposal stage.