Reviewed and updated October 8, 2026.
A knowledge assistant needs to return only evidence the requesting user may read. Index access is not the same as document access. If a broad service account can search every record, the application must still enforce the user's tenant, group and object permissions before protected content enters model context.
This article focuses on retrieval and derived information. Agent identity and delegation covers whose authority is used for execution. Both boundaries need enforcement outside generated text.
Keep source identifiers, tenant boundaries, access metadata and permission versions with documents and chunks. Derive the caller's identity from trusted authentication infrastructure. Filter retrieval with the policy relevant to that caller, and verify that additional search paths cannot bypass it.
Azure AI Search documents security filters and native document permission approaches. Some token-based capabilities are marked preview in the documentation checked in October 2026. Source permission changes become effective in indexed results after the documented synchronization process, so test that delay for the source and API version used.
Suppose an employee moves from a sales team to an operations team. The employee previously had access to a confidential sales plan. This is a proposed test case, not an observed deployment result.
After the change, ask for the plan by exact title, paraphrase and a remembered follow-up question. Check direct retrieval, hybrid search, reranking, cached answers and conversation memory. The assistant must not reuse an old answer merely because the same user identifier remains valid.
A proposed cache key includes tenant, effective access context, policy revision, source version and request identity where required. Invalidation rules must cover membership and document ACL changes. Alternatively, cache approved source fragments and reauthorize them before assembling an answer. Choose according to the required freshness of permission decisions.
A blocked body with a revealing citation title can still disclose information. Apply policy to source labels, previews and download links. Logs, evaluation exports and administrator review screens need their own access and retention controls. A public citation renderer must not bypass the source system's permission check.
Database enforcement is another option. PostgreSQL row security has special behavior for superusers, bypass roles and normally table owners. Test the actual application role; enabling row security while connecting with a bypass role does not establish the intended boundary.
Test another tenant's record, mixed-permission documents, nested group changes, deleted sources and failed ACL refresh. Missing or stale access metadata should produce a defined denial or unavailable state, not a broad retrieval fallback. Check writes separately: permission to read a record does not authorize modifying it.
A small approved collection with uniform access can be a simpler starting point. Per-user retrieval becomes necessary when the workflow spans distinct access groups. Neither choice removes the need to control the data sent to the model provider or stored in traces.
For an assistant over governed sources, see enterprise knowledge assistants. Request a project review with the source ACLs, user groups and revocation behavior the application must preserve.
Optional Google Analytics stays off until you choose Accept analytics.
