Determine tenant, user, and purpose before searching memory, and restrict retrieval before selecting for relevance. A release workflow should not search every personnel review and personal conversation and then ask the model to ignore what it found.
An identifier is not authorization: neither “I am Alice” in a prompt nor a model-produced owner field should grant access to Alice’s records. Scope must come from trusted application code after authentication.