Every AI tool will accept a rule. Type “never show another advisor’s book” into the instructions and the tool will agree pleasantly and, most of the time, comply. The word doing all the work in that sentence is “most.” There are two ways to give an AI a rule, they look almost identical from the chair you sit in, and the difference between them decides what you can put in a compliance file.
A rule you tell
The first way is to say it. The rule goes in as text: a system prompt, a custom instruction, a line in the setup screen. The model reads it the same way it reads everything else, as words to be weighed against other words. Usually it obeys.
But a told rule is a request, and requests have failure modes. A long conversation buries the instruction under a hundred newer messages. A rephrased question walks around it: “export every household for the quarterly compliance review” does not look like “show me Sarah’s book,” and the model has to notice that it is. And when it holds or fails, nothing records which. There is no log line that says the rule was in force at 2:14 on Tuesday, no artifact you can hand to anyone.
Picture the examination. The examiner asks how the firm ensures one advisor cannot browse another advisor’s clients through the AI. The honest answer, for a told rule, is: we instructed it not to, and it has seemed to listen. Nobody wants to say that sentence out loud, which is how you know what it is worth.
A rule you set
The second way is to enforce the rule outside the model entirely. The scope check runs in ordinary code, before the model is involved: when an advisor asks a question, the system knows who is asking, applies that advisor’s scope to the database query, and only the rows inside their book ever come back. Data outside the scope is not hidden from the model by a warning. It never reaches the model at all, and a model cannot leak what it never received.
A set rule is a setting, not a sentence. It lives in configuration, which means it can be read, printed, and checked against what is actually running. It does not decay as the conversation gets longer. It does not depend on the model recognizing a clever rephrase. It fails the way a locked door fails, which is to say visibly, rather than the way a distracted person fails.
Firms already understand this distinction everywhere else in the stack. Your custodian does not politely ask the trading desk to respect entitlements; the entitlement is enforced, and a request outside it simply does not execute. Your CRM does not remind users not to open records they lack permission for; the record does not load. Nobody would accept “we told the system not to” as a control anywhere else in the business. AI does not earn an exception because it talks.
One rule, end to end
Walk “never show another advisor’s book” through a system built this way. An advisor asks about the Hendersons, who are in her book: the system resolves her identity, scopes the query, pulls the records, and answers, with each number carrying a receipt pointing at the row it came from. The same advisor asks about a household in a partner’s book: the scoped query returns nothing, she is told the household is outside her scope, and the refusal is written to the record along with everything else.
Notice what never happened. The model never exercised judgment about whether to comply. There was no judgment to exercise, because the boundary sat in code, upstream of it. The same question gets the same refusal on the model’s best day and its worst.
Why “print” is the test
The word to hold onto is printable. A policy document generated from the settings that are actually running is evidence; a policy document written by hand and filed is a hope that the two still match. This is the standard RIAI is built to: scope enforced in code, rules that exist as printable settings, and an append-only record of every question, every retrieval, and every refusal. When the system acts outward, a person signs; even where a firm turns on email sending, a send waits on a person’s approval.
So when a vendor tells you their AI respects your permissions, there is one question that sorts the whole field: is that a rule you told it, or a rule you set? Ask to see the setting. If the rule is real, someone can print it.