How do I stop AI from seeing files it should not see?

Enforce access before the AI retrieves anything. Use user identity, role-based permissions, approved folders or data sources, and scoped service accounts so the AI can only search information the current user is allowed to access.