A multi-tenant enterprise RAG product retrieves the top-20 chunks from a shared index and generates an answer. It then strips any citation the user cannot access before returning the response. A security review flags this design. What is the actual flaw, and what is the fix?

1. A The model can spoof citations, so the fix is to sign each citation ID server-side and verify the signatures before rendering the response.
2. B The filter runs too late for latency reasons. Moving the same ACL check to a cache layer in front of the response makes it both safe and fast.
3. C The shared index is the problem. The only safe fix is a physically separate vector index per user, so ACLs never need evaluating at query time.
4. D The model already read restricted chunks and can paraphrase them. ACLs must be enforced as a filter inside the retrieval query, before generation.