The rule that a person's permissions are applied in the data layer before any row is read, so a salesperson's question is answered from their own accounts only and the assistant cannot leak what it never saw.
A permission expressed in a prompt is a suggestion the model may misread. A scope resolved to account identifiers before the query runs is a guarantee. In a bank the difference is the whole security review.
Switch the persona and the rows change, not just the presentation. A salesperson asking about a region they do not cover gets an empty set, because the rows are genuinely unreachable.
A person's permissions are applied where the data is read, before any row reaches a calculation or a model. A salesperson's question is answered from their own accounts only, and totals they cannot see are not computed for them.
A rep asks for the top accounts by margin. The query runs over the 300 accounts in their book. A manager asking the same question gets the team's 2,400.
Filtering applied to the answer after the fact. The model has already seen rows the person should not.