How do you adjudicate between using output-side filteri...

Output-side filtering is insufficient as a security control because the model has already processed the restricted information by the time it generates a response. Even if the literal source text is stripped, the model can still paraphrase or leak the disallowed facts. Retrieval-time filtering is the only effective control, as it prevents the model from ever conditioning on the restricted data. While this may require additional development time, it is the only way to ensure compliance with data-sharing agreements.