RAG Access Control: Test the Documents a User Must Never Retrieve

A document assistant can produce a correct answer and still fail its most important acceptance check....