This is the internal version of tenant isolation and it is enforced at answer time: every fact knows its origin and audience, and retrieval filters on the asker before the model ever sees the context.
Design nuance: Heidi biases toward knowledge flowing in the open, because that is where it compounds, but the bias never overrides a source's permissions. Open by default, private where the source was private.