Grounded answer citations
Opening a citation is another access check
Search permissions do not automatically protect a saved answer or its source preview. Review every place where citation evidence can be read or shared.
In this article
Follow the evidence beyond retrieval
A permission-aware search may correctly limit passages when an answer is generated. The answer can then be saved, emailed, exported or opened by a different user. Each step creates a separate question about who can read the evidence and the claims derived from it.
Map these paths before choosing a citation storage format. Storing a full source excerpt with an answer makes inspection convenient, but it also creates another copy of potentially restricted information. Storing only a reference reduces duplication, yet the reader may lose access to the evidence later. Neither choice removes the need for an explicit policy.
A link that returns access denied does not protect an excerpt already visible on the answer page. Review rendered text and downloadable formats as well as the destination URL.
Define what sharing an answer permits
Decide whether a shared answer inherits the original source permissions, uses a separate approved sharing rule or cannot be shared across an access boundary. This is a product decision backed by the organisation's data policy, not something a citation component should invent.
Check permission changes after generation. If someone leaves a project, can they still open answers containing that project's excerpts? If a document is reclassified, do saved answers remain available? The required behaviour may differ by data type, so avoid one undocumented assumption for the entire library.
Use server-side checks at the evidence endpoint. Hiding a citation button in the interface is not an access control. An identifier should locate an authorised record, not act as a secret that grants anyone who knows it access.
Inspect secondary copies
Review search indexes, answer caches, logs, analytics, exports and support tooling. Citation text can enter these systems through normal debugging even when the main application handles access correctly. Record which copies contain source text and which contain identifiers only.
Give operational staff the minimum evidence needed to investigate a failure. A support record can often use answer and source identifiers without including the passage itself. Where text is necessary, apply the same classification and retention expectations as the source.
Signed or temporary source links need careful handling too. Do not place them in publicly cacheable pages or unrestricted analytics events. Their exact security properties depend on the source platform, so verify expiry and audience behaviour rather than assuming every generated link is safe to share.
Test a change in authority
Create an answer while a test user has access, then remove that access and exercise the saved page, reference endpoint, export and cached preview. Repeat as a different user receiving a shared answer. These tests reveal where permissions were captured once and never reconsidered.
Document the expected outcome for each path. If historical evidence must remain available to a designated audit role, implement that role deliberately. Do not preserve broad access accidentally because the original requester once had permission. Citation access belongs to the same security model as the information it exposes.
Primary sources
OWASP: authorisation guidanceMicrosoft Learn: search security filtersReferences checked 11 September 2026.