How do you adjudicate a request to have an LLM extracto...

Refusing the feature is not an answer, as users naturally express authorization in language. The risk is that if the extractor generates the permission clause, an attacker could manipulate the prompt to widen their access. The solution is to treat authorization as a system-enforced constraint that is applied after the LLM has performed its semantic narrowing, ensuring that the user’s team-based permissions are always respected regardless of what the LLM generates.