I wanted one role in the platform: this analyst can run the assessment and cannot touch the evidence it reads.
That role doesn't exist. Owner, editor, viewer, and that's the whole list. A viewer gets correctly refused four out of four ways in, including the route that skips the document pipeline and writes straight to the vector store. But a viewer can't start a conversation either, so a viewer can't run the instrument.
The person operating the assessment is the same person who can rewrite what it reads.
That isn't a product defect. It's ordinary access control, and no permission fixes it, because the capability you'd withhold is the capability you have to grant. So how do you control it? You don't prevent it, you catch it. Enumerate the corpus, diff it against the set you approved, and run that check before anything gets scored instead of as a report afterward. Same code, different place in the pipeline, and only one of those is a control.
Inherit the boundary. Own the gate.
Disclosure:
@KamiwazaAI sponsored this lab. They didn't choose the vendors, see the instrument, or hold a veto.