We design the permissions structure before we wire the AI. Role-based retrieval, audit logs, and guardrails mean your company brain is useful without becoming a compliance liability.