Your RAG Shows Its Sources. It Doesn't Say How Sensitive They Are.

This is the Output piece of the Infozense Knowledge Engineering library. The data layer beneath your agent has five gates: Input (who may ask) · Egress (what may leave) · Output (safe and true) · Action (who approves) · Operational (prove it later). This piece is about the third: Output, the gate that governs the answer itself, after the model has written it.

Four source documents each carry a classification. The model reads them and writes an answer that carries no marking at all, and that answer is then forwarded into email, a shared channel and a client deck. — The model reads four labelled documents and writes an answer that carries no label at all.

เมื่อยังไม่มีเลเยอร์ข้อมูลที่มี Governance เอกสารต้นทางสี่ฉบับ แต่ละฉบับมี Classification ติดอยู่ โมเดลอ่านทั้งสี่ฉบับนั้น แล้วเขียนคำตอบใหม่ออกมา ซึ่งไม่มีป้ายกำกับใด ๆ ติดอยู่เลย จากนั้นคำตอบก็ถูกส่งต่อเข้าอีเมล เข้าช่องแชทที่ใช้ร่วมกัน และเข้าสไลด์สำหรับลูกค้า — The model reads four labelled documents and writes an answer that carries no label at all.

When your team put an AI assistant over your own documents, making it cite them was probably the first thing your team made sure of. They were right to.

So its answers now carry their sources. Every claim points at one of your own documents. A reader who doubts something can click through and check. The transparency problem, as it was framed, is solved.

Here is what the citation does not tell them.

It does not say what those sources were. A link tells your reader where the answer came from. It says nothing about whether the material behind that link was the published product brief or the case file, and therefore nothing about what the answer in front of them now is.

Which matters, because that answer is about to be forwarded.

Who this is for

If everything your AI can reach is material anyone in your organization may read, this is not your problem. Stop here.

This piece is for you if your AI draws on documents with different levels of confidentiality, and the people using its answers cannot tell that an answer contains confidential material. For example:

a compliance officer pasting a summary into an email
a team lead forwarding an answer to a group chat
an analyst putting a paragraph into a client deck

None of them are careless. Nothing on the screen tells them the answer contains confidential material.

A simple test. As someone allowed to read a confidential document, ask your AI one question that needs both it and ordinary ones to answer, and confirm the confidential one is among the cited sources. Then check two things:

Apart from the words the AI wrote, does anything on the screen show the answer's classification, such as public, internal or confidential?
If there is a classification label, ask the team that built the system: is it the same one the system uses to decide whether a confidential document may be sent to an outside model?

If either answer is no, this piece is for you.

The AI writes a new answer. The classification does not come with it.

Your organization has spent years classifying documents. The case file, the board pack and the HR record all carry a label that says how confidential they are, and people are trained to check it before they pass anything on.

An AI answer is not one of those documents. The model reads four of them and writes new text of its own. In the usual setup, no step works out the classification of those four documents for the answer, so it appears in the chat window with no label at all.

Asking the AI to say how confidential its own answer is only gets you a guess. The model writes something that sounds reasonable, but it does not come from a rule anyone can check, and asking again can give a different result.

Usual RAG

1. Four documents are found

Product briefpublic

Release notepublic

Case fileconfidential

Published policypublic

→

2. The model writes, picking what comes next

“The complaint was closed because …”

a refund was paid

41%

the fault was fixed

33%

the customer withdrew

18%

other

8%

What comes next is picked by probability.

→

3. A new answer appears in the chat

The complaint was closed because a refund was paid, on the settlement terms recorded in the case file…

No classification

Ask the model: “How confidential is this answer?”

Try 1: confidential Try 2: internal Try 3: confidential

A guess that can change each time you ask. Not a rule anyone can check.

Illustration. Nothing in this pipeline works out the answer’s classification, and the model can only guess it.

And the answer is often more damaging in the wrong hands than any one of its sources, because the AI has just pulled the important parts of each one together in one place.

The answer inherits the strictest thing that built it

Nothing in the usual RAG design does this. It searches your documents, hands the best passages to a model and shows the links. Even where the search index knows each document's classification, and uses it to decide who may search what, nothing turns that classification into a property of the answer.

The fix is not to label answers by hand. Nobody can, at the rate a model produces them.

The fix is that sensitivity travels. In a governed data layer, every piece of retrieved material already carries a classification, and when the layer assembles an answer it takes the strictest classification among everything used. Not the average. Not the first. The maximum of what actually went in.

That value is attached to the answer and shown with it. One confidential paragraph among four public ones makes the whole answer confidential, and it says so, on the answer, where the person about to forward it will see it.

This is the same arithmetic the layer already uses to decide which model may see the material. Here it is being used for the person, rather than for the machine.

One classification labels the answer and chooses the model

With Infozense Knowledge Engineering. The four sources feed one function that works out the strictest classification present. That single value has two consumers: it decides which model may see the material, and it is the marking shown on the answer. Both come from the same function, so for every source the marking matches the rule. — One function, two consumers. For every source, the marking and the rule are computed together.

เมื่อมี Infozense Knowledge Engineering แหล่งทั้งสี่เข้าสู่ฟังก์ชันเดียว ซึ่งหา Classification ที่เข้มที่สุดในบรรดาแหล่งทั้งสี่ ค่าเพียงค่าเดียวนั้นถูกนำไปใช้สองอย่าง อย่างแรก ใช้ตัดสินว่าโมเดลตัวไหนมีสิทธิ์เห็นเนื้อหานั้น อย่างที่สอง ใช้เป็นป้ายกำกับที่แสดงอยู่บนคำตอบ ทั้งสองอย่างมาจากฟังก์ชันเดียวกัน ป้ายกำกับจึงตรงกับกติกาเสมอ ไม่ว่าแหล่งที่มาจะเป็นแหล่งไหน — One function, two consumers. For every source, the marking and the rule are computed together.

In a governed data layer, the classification does two jobs:

It shows the person how confidential the answer is.
It decides which model may see the material: an outside model, one your organisation owns or controls, or none at all, according to the rules you set.

Both jobs use the same function, so the label matches the decision about which model may see the material, whatever the source.

Two more rules keep the label from showing an answer as safer than its sources.

An unlabeled source shows as restricted, never as public. If the material behind an answer carries no classification at all, the layer does not treat the absence as permission. It marks the answer as the most sensitive thing it could be. A gap in your metadata makes the warning louder, not quieter.

The label describes the material, not the reader. It does not tell the person whether they were allowed to see this. Something else already decided that, before retrieval. This tells them what they are now holding, which is the question they are about to answer with their own judgement when they decide where to paste it.

The honest limit

Once that answer leaves the screen, the marking does not follow it. Copy the text into an email and you have copied the text.

This is worth saying plainly: no system can guarantee the text will not be copied out. What the layer can do is tell the person copying it how confidential it is. If they know and forward it anyway, that is their decision. If nobody told them, the leak happens without anyone choosing it. That difference is what an auditor will ask about afterwards.

The bottom line

Citations answered the question your team asked when it built the assistant: where did this come from. They did not answer the one your compliance officer is asking now: what am I holding.

An AI answer is new text that needs a label. Left unmarked, it moves through your organization looking exactly as harmless as a chat message, carrying whatever was most sensitive in the documents behind it. Marked, it is just another classified artifact, and your people already know what to do with those.

You don't build this. You configure it.

You do not write this rule or maintain a second labelling pipeline for answers. Infozense Knowledge Engineering ships the governed layer with the Output gate already in place: every source carries its classification, every answer takes the strictest one present, unlabeled material counts as most sensitive, and the value your people see is the one the layer enforces with. You classify your knowledge once. The answers label themselves from then on.