AI knowledge base and permissions: who can read what answer

One AI knowledge base with permissions must respond using only the sources that that person is allowed to read. Relevant research is part of the project; the authorization decides what content can enter into the recovery, response and citations. Writing in the "not showing confidential documents" prompt does not apply these controls.

For an SME the practical question is who sees what, even after a change of role or a revocation. This guide addresses accesses, copies in the index and denial tests, with official sources verified the 9 October 2026. The AI Guide for Companies provides the framework for adoption; the knowledge base company with AI describes the general use of research in documents.

What identity does the question start from?

Before connecting documents, define how the assistant recognises the person. The name typed in the chat must not assign a role. A system-verified identity and a link to company groups or permissions are required. The model must not decide that someone is an administrator because they claim to be one in a message.

Avoid that the link always uses the privileges of the project owner to respond to anyone. A technical account may need to read the sources when indexing, but this does not mean that every user can receive the content. The project must distinguish connector capacity and applicant rights.

The Microsoft 365 Copilot privacy documentation describes access to user-authorized content. It is a property of that product and its context. An application built on a separate index must demonstrate its behaviour, without automatically transferring this guarantee.

Who can see what documents?

Prepare an understandable matrix for the operations manager as well. It must not contain every technical detail, but must show the real rules: common procedures, files per customer, economic documents, drafts and excluded material. For sensitive cases it is necessary to indicate who can grant access and under what condition.

A matrix based only on departments may be insufficient. One person can work on multiple clients, while two colleagues in the same department can have different assignments. Define the rule that matters in the process. If it does not exist today, the project must bring out the choice before indexing.

The index keeps a copy with what rules?

A knowledge base can divide documents into parts and store representations of them for research. The project must maintain the identity of the source, version and information useful for authorization. A fragment without provenance may become impossible to update or remove when the original file changes.

The Azure AI Search documentation on document-level control It distinguishes supported mechanisms and sources, with functions that can be previewed. The reference shows that permissions are an explicit component of recovery. Availability and configuration must be verified for the specific connector used.

Do not leave the model the choice to include a banned content because it is useful to the response. The control must be applied by the system. If the recovery already returns unauthorized material and the prompt asks to ignore it, the barrier is placed too late: that text has entered the processing path.

The Guide to RAG explains the recovery before the generation. For permissions, a question must be added: what sources can this user recover now? It is a verification distinct from semantic similarity and must work even when the application accurately cites the title of a classified document.

Research and authorization metadata are different things

Customer, department, status and date help to choose relevant documents. If the user asks for a proper location procedure, the filter can improve the result. But a value generated by the model is not a proof of access. The rule must start with the verified identity and authorisations, not the wording of the application.

The theme is close to SharePoint metadata in the Foundry IQ recovery. A version or department filter may be useful, but the project must verify permissions separately. Confusing the two functions leads to a convincing demo with well-chosen documents and accesses still too wide.

The Microsoft documentation on the security trimming pattern describes filters related to identities or groups and highlights their management limits. It is a possible architecture, not an invitation to insert a username into any filter. Control must prevent the applicant from changing his or her perimeter.

The problem of documents already shared too widely

The assistant can make it easier to find a file that few people know about today, while still respecting existing permissions. If the folder is open to the whole company by mistake, the AI cannot know that the person in charge wanted closer sharing. The project must verify the material before amplifying its availability.

It starts with a limited and controlled collection. For each source ask owner, expected users and valid version. A "reserved" label in the title does not alone change the rights. Similarly, a folder called "public" may contain an attachment that requires different treatment.

Avoid correcting the entire archive to start a small pilot, but do not include sources without a handler. You can exclude a folder and flag it as out of perimeter. It is a reversible choice that allows you to test the path on governed documents, while the enterprise clarifies the most complex cases.

How to handle a revocation or a change of role?

Define the event that updates the right of access and behavior while the update is not confirmed. The person in charge must know the range expected by the system and how to block the content if necessary. Do not declare an immediate revocation if the path depends on unverified synchronizations.

Check for new questions, but also already shown links, caches and saved views. A previously obtained response may have been exported: the project must distinguish what can prevent from what has already been delivered to an authorized user. Do not promise to withdraw any copy with a single group edit.

In the test, revoke an access, change a membership, and remove a document from the collection. Then try the same question and a different question looking for the same content. A check based only on the identical text could hide a problem in the other recovery routes. It records the moment when each path stops returning the source.

Answering, Quotations, and Conversation Memory

The answer can reveal a source even without citing the text. A title, customer name, amount, or preview can be sensitive information. The tests must therefore observe all the elements shown by the interface, not just the main paragraph. A link must also respect the authorized path.

Do not reuse a generated response for one user as free material for others. If the system retains shared memory or cache, it must apply rules that are consistent with the content. Risk is not just about the original index: it can enter the project through a shortcut designed to speed up responses.

If there are no authorized sources, the system must state the limit of business demand. It can indicate the intended path to request access, without confirming the existence of a file that the user must not know. The wording must be checked on the context: even the denial message can say too much.

Hypothetical scenario: a technical study in Bergamo

In this hypothetical scenario a study wants to consult common procedures and client files. Collaborators must only access assigned practices. The pilot uses a limited collection with verified assignments and an owner for each source. Common research remains distinct from project material.

An authorised user finds a procedure and a reference to the correct case file. Another user requests the same document by citing its title. The system must not retrieve the confidential source or show a preview. The test then includes removing the assignment, to check the new response after the change.

The responsible measures correct denials, authorised recoveries and observed update times. It also checks a bad shared folder, which must be corrected or excluded from the sample. The result is not described as automatic compliance: it is a test of precise behavior on a defined perimeter.

Hypothetical scenario: a food producer in Parma

A second hypothetical situation concerns establishment procedures and economic documents. Operators must find up-to-date operating instructions; some commercial conditions remain accessible to a restricted group. A single assistant may be comfortable, but must maintain this distinction before recovery.

The pilot inserts an approved procedure and a later draft with different access. The operating response must use the version intended for the user. The authorized auditor can compare copies through the flow of document version comparison, without making the draft available to all.

Evidence includes a citation, a download, and a new question after a revocation. The firm assesses how many sources need to be cared for and how much it costs to keep rights and versions of them. A model capable of writing well does not reduce this organizational work and should not be used to replace it.

What track does it take to figure out the wrong access?

The project must be able to reconstruct user, retrieved sources, applied rule and shown result, with proper log accesses. There is no need to copy all the documents indiscriminately in the diagnostics. A trace with identifiers and versions can help investigate while keeping the stored content limited, according to the design of the system.

If a test reveals an unauthorized source, check where it entered: connector, index, filter, cache, or conversation memory. Correcting the prompt without knowing that point can hide the test case and leave the same path open with a different question. After correction repeat the test and the nearby paths involved.

Assign a manager to configuration changes. A new collection, an updated group, or an added export can change the perimeter. Denial tests should accompany these changes, with repeatable examples and test identities. The system must continue to demonstrate rights even after the first delivery.

Pilot, budget and model choice

Prepare expected questions and banned questions for at least two distinct roles in the chosen perimeter. Run tests with real test identities, avoiding the admin account for everything. Counts correct answers with allowed sources, correct denials, and any information revealed out of perimeter. For a missed denial, investigate the route before expanding the archive.

Current models are candidates to compare on the quality of the authorized responses. You can rate Claude Sonnet 5.5 on the sample, but the selection of the model does not solve the authorization. The project must separate text quality tests and rights tests, to understand where the problem lies.

The budget includes review of shares, identity linkage, index management, review monitoring and test maintenance. Add cost of recovery, generation, and support to users. A proposal that only counts calls to the model does not describe the work needed for a knowledge base used by people with different accesses.

Evidence of denial that must not be lacking

• User external to the group asking for the exact title of a file.
• User with access to the main document but not the attachment.
• Access has just been revoked, with a new question and a citation already present.
• Saved response or cache that may contain sources of another role.
• Document removed from the collection and fragments still present in the index.

Which collection should we start with?

Choose curated sources, identifiable users, and a person in charge who can decide on the rights. Customer Document Collection when it is necessary to prepare the sources: the presence of a file does not automatically authorize its use by all. AI and GDPR helps to place the treatment in the larger project.

With the service AI agents You can design a knowledge base that makes accesses, sources, and revocations verifiable. It carries the role matrix and a small collection already governed. The pilot must demonstrate who can get what answer before becoming a search open to the entire archive.