Security of an AI assistant: threats and protection

-- Rights are checked in the search, not in the instruction to the model:
-- the model never sees a document the user may not read.
-- $1 — the vector of the question, $2 — the groups of the current user
SELECT c.source, c.text
FROM chunks c
WHERE c.access && $2::text[]   -- at least one common group
ORDER BY c.embedding <=> $1
LIMIT 4;

// The answer of a model is untrusted text, like a form field from a stranger:
// it is shown as text and never inserted as HTML
export function showAnswer(box: HTMLElement, answer: string): void {
  box.textContent = answer; // <script> and <img onerror> stay harmless characters
}

// Links only from an allow-list of your own pages, whatever the model wrote
const ALLOWED = new Set(['/delivery', '/returns', '/warranty']);

export function safeLink(path: string): string | null {
  return ALLOWED.has(path) ? path : null;
}