A processor types “recent income exceptions” into your new AI assistant. One of the answers it returns is a tax return from a different branch’s pipeline, SSN included. That is not a bug. It is the default behavior of a vector database with no access controls, and for a lender holding borrower NPI it is a GLBA safeguards failure.
Vector search finds semantically similar text. It has no concept of who is cleared to see what. A query for “bank statement” scans the entire index and returns the closest matches, authorized or not.
Post-filtering, where you pull 100 chunks and then drop the ones the user cannot see, is the wrong fix. It wrecks relevance and latency, and one missed rule still leaks.
Pre-filter before the vector comparison
Narrow the search space before the similarity math runs. That means capturing access rights at ingestion.
- When a document lands from Encompass or your DMS, record its scope as metadata: which lender it belongs to, which pipeline, and an access-token list (for example,
group:qc_reviewers). - At query time, resolve the user’s identity from your directory (Microsoft Entra ID, formerly Azure AD, or Okta) and expand their group memberships.
- Send the filter with the query: return chunks similar to the question WHERE the user’s groups intersect the document’s access tokens.
Multi-tenant isolation is the mortgage-specific part
One lender’s files must never surface in another lender’s queries. Tenant ID becomes a hard pre-filter on every search, never a soft ranking signal. The same mechanism enforces the separation Fannie Mae already requires of QC: Selling Guide D1-1-02 says QC employees must be independent of the production, underwriting, and closing departments.
Log every retrieval
Each answer should record who asked, what came back, and which permission allowed it. That trace is what a SOC 2 or GLBA examiner asks for, and it is what lets you prove a leak did not happen.
This is how Mortna’s guideline intelligence is built: retrieval scoped to the client first and ranked second, borrower NPI walled off, every cited section logged.