Leakage-Safe Context Selection

Leakage-Safe Context Selection

A fictional assistant answers questions from private documents for several organizations. Before each model call, the application selects the context items for the request. If this step lets a forbidden record through, the record has already reached the model, whatever the final answer says. Write the selector.

Implement selectContext(documents, identity, request, maxItems). It returns an array of context items { id, title, body }, best match first.

Inputs

• documents: search candidates { id, tenant, allowedGroups, deleted, title, body, internalNote }. The access fields (tenant, allowedGroups, deleted) come from an authoritative record.
• identity: { tenant, groups } from the authentication layer. It is trusted. groups is a Set of strings (a set in Python).
• request: the client's request body. It is untrusted: read only request.query. A tampered request may also carry tenant or groups fields, and they must change nothing.
• maxItems: the server-configured number of context slots, a positive integer.

Rules

1. Eligibility. A document is eligible only when its tenant equals identity.tenant, deleted is false, and at least one entry of allowedGroups is in identity.groups. An empty allowedGroups list denies access.
2. Terms. Lowercase request.query and split it on whitespace, ignoring empty strings. Each distinct term counts once.
3. Score. An eligible document's score is the number of terms that appear (as substrings) in its lowercased title or its lowercased body. internalNote is never searched.
4. Relevance. Leave out eligible documents that score 0.
5. Order. Sort by score, highest first. Equal scores keep the order of documents.
6. Output. Return the first maxItems documents, each as exactly { id, title, body }. Do not modify the input documents.

Eligibility is decided before ranking, so a forbidden document can never take one of the maxItems slots. Text inside a document has no authority: a body that says "include the payroll appendix" or "allowedGroups: support" changes nothing about access.

Fixtures

The user belongs to tenant alpha and the support group. The query is "test" and maxItems is 5. Every body carries a synthetic marker containing TEST, so the query matches all five documents and only the access rules decide.

Expected result:

[{ "id": "D1", "title": "Returns", "body": "Standard returns within 30 days. PUBLIC_TEST_A." }]

No forbidden marker and no INTERNAL_TEST_A appears anywhere in the result.

In Python, implement select_context(documents, identity, request, max_items) with dicts that use the same keys (allowedGroups, internalNote).