To keep an enterprise AI assistant from exposing content to the wrong person, secure the source repositories first, authenticate each user, and authorize every retrieval before its content reaches the model. Managed copilots can apply existing platform permissions, but custom retrieval-augmented generation (RAG) applications must implement and verify that authorization path themselves. A connector’s access-control filtering can help; it is not, by itself, authentication or a complete security boundary.
Why repository permissions matter before AI rollout
A permission-aware assistant generally works within the signed-in user’s existing access. That helps preserve the repository’s access model, but it also means content that is already overshared can become easier to discover through search, summaries, or conversational questions. AI does not repair poor permissions.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Copilot preparation guidance recommends finding and remediating overshared, ownerless, inactive, or sensitive SharePoint sites; addressing anonymous and excessive access; correcting permission inheritance; and assigning accountable site owners. It also describes temporary safeguards, such as restricted content discovery or data loss prevention (DLP) controls, while remediation is underway. Treat an exclusion from AI discovery as a temporary safeguard, not a replacement for fixing the repository’s access rules. Validate that the safeguard is working, correct the underlying permissions, and remove the temporary measure only when the risk is addressed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start with a focused access review
- Find repositories with anonymous links, broad organization-wide groups, unusually large audiences, or broken permission inheritance.
- Check for sensitive files, ownerless or inactive sites, stale memberships, and accounts that no longer need access.
- Set sharing and site-provisioning defaults to reduce future oversharing, and apply appropriate site labels.
- Assign owners who can approve access and periodically review it.
Choose an authorization model before indexing content
For a custom RAG system, decide explicitly who the principal is, what resource is being requested, what action is allowed, and which policy makes that decision. The policy might combine document-level permissions with department, tenant, role, classification, or business-purpose rules. Map repository identities and groups to authenticated application users; plan for nested groups, permission changes, revocations, and source deletions.
#1 Best Overall
Each indexed document or chunk should retain the source identifier and the trusted permission and classification metadata needed to evaluate access. AWS guidance recommends classifying data at ingestion and describes metadata filters for attributes such as department, role, clearance, and classification. The application or agent must add the appropriate filter to the retrieval request.
Keep authorization out of the prompt
Build retrieval filters from server-validated identity claims and policy data—not from a user-supplied filter, a prompt, or an access decision generated by the language model. Treat the model as an untrusted consumer of already-authorized context, not as the authority that grants access. Choose a deny-by-default response for cases where an identity or policy dependency is unavailable. AWS’s Verified Permissions and Cedar architecture example describes runtime policy evaluation and retrieval-time document-level controls with deny-by-default behavior.
Enforce access before content enters model context
Authorization needs to apply to the actual records selected for a response, not just to the user interface or a general search page. In custom RAG, check the authenticated user’s rights during retrieval and before retrieved text is assembled into model context. Preserve enough provenance to identify which source records informed the answer.
AWS documents a specific Amazon Bedrock Managed Knowledge Base example for SharePoint: it filters candidates using ACLs synchronized during the last crawl, then verifies access against current SharePoint permissions in real time. AWS also warns that ACL awareness is filtering, not authentication; the calling application must authenticate the user and pass verified identity context, and the feature should not be the sole access-control mechanism. Do not assume another connector has the same behavior.
Questions to resolve for any connector
- Does it enforce unique item-level permissions as well as inherited permissions?
- How does it resolve groups, including nested groups, and what happens when membership changes?
- How quickly do permission changes and revocations take effect? Is access checked against the current source at request time?
- What happens to deleted documents, stale index entries, and content whose permissions change during a sync interval?
- Does a failed identity or policy check deny access, or can retrieval continue?
- Can the application prove that only authorized text reaches model context?
If a connector cannot demonstrate safe behavior for the permissions and edge cases your organization relies on, add an application-level authorization check or isolate the data in separately controlled stores. Make the failure behavior explicit and test it.
How the documented approaches differ
The following comparison describes only the behaviors documented for these examples. It is not a guarantee for every edition, connector, tenant, region, or deployment.
Rank #4
| Approach | Documented permission behavior | Identity or implementation responsibility | Important qualification |
|---|---|---|---|
| Microsoft 365 Copilot | Microsoft says access controls and policies apply, including identity, permissions, sensitivity labels, retention, audit, and administrative settings. | Use the selected Microsoft 365 identity, permission, and governance configuration. | Specific controls vary by subscription; verify the selected product and terms with Microsoft’s enterprise data-protection documentation. |
| Amazon Bedrock Managed Knowledge Base with SharePoint ACL-aware filtering | Pre-retrieval filtering uses ACLs synchronized during the last crawl, followed by real-time verification against current SharePoint access. | The calling application authenticates the user and passes verified identity context. | AWS states that ACL awareness is filtering, not authentication, and should not be the sole access-control mechanism. |
| Custom RAG application | The application can apply runtime policy evaluation and retrieval-time document-level controls; AWS describes this pattern with Verified Permissions and Cedar. | The application must implement identity mapping, policy evaluation, trusted filters, and the failure behavior. | Exact connector coverage, permission freshness, and edge-case support depend on the implementation; do not assume them. |
Microsoft’s enterprise data-protection documentation states: “The prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models.” That statement is specific to Microsoft’s documented product context; the same documentation says applicable commitments are governed by the Data Protection Addendum and Product Terms, and that particular controls vary by subscription.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Classify and minimize sensitive data
Define a classification scheme with handling requirements before indexing. For each category, decide whether content may be indexed, whether it needs additional access restrictions or redaction, and how long it should remain available. Keep only content needed for the use case and remove obsolete records. Some categories may be unsuitable for grounding at all.
Best Value
AWS guidance recommends classification tiers and describes using tools such as Macie for discovery in S3 sources and Comprehend to detect or redact sensitive information before indexing. Whether these tools fit depends on the source and data. Classification metadata must stay accurate as content changes; an incorrect label or stale permission attribute can undermine retrieval filtering.
Protect the full data path
- Encrypt stored knowledge-base data and related resources, and scope encryption keys appropriately.
- Use TLS 1.2 or higher for data in transit, as recommended in AWS guidance.
- Grant service roles only the permissions needed for ingestion, retrieval, and administration.
- Use private networking and carefully scoped resource policies where the environment requires them.
- Apply DLP, sensitive-data detection, redaction, retention, and output controls where they fit the data and use case.
Monitor access and test the controls continuously
Log authorization decisions and enough retrieval provenance to investigate which source records were used, subject to privacy and retention requirements. Monitor relevant prompts, responses, cited or referenced documents, policy changes, connector syncs, and unusual access patterns. Microsoft recommends ongoing risk assessments, activity and sensitive-data reporting, DLP alerts, insider-risk signals, and audit. AWS recommends CloudTrail and CloudWatch logging and tracking relevant API activity. Review and recertify access as users, groups, repositories, and business purposes change.
Build an access test set
Use at least two test identities with different access levels and include sensitive records, group and inheritance edge cases, revoked access, stale or deleted documents, and prompt-injection attempts embedded in retrieved content. These are prudent test cases for the documented control surfaces, not evidence that any specific product has passed them.
Quick Recap
- Sign in as each test identity through the application’s normal authentication path.
- Request the same protected record through search, a direct question, and a follow-up prompt. Confirm that an identity without permission cannot retrieve it or receive a summary of it.
- Check citations, user-visible logs, and other response surfaces for unauthorized source details.
- Change or revoke a test user’s source permission, then verify how quickly the change takes effect in both retrieval and any relevant cached or indexed content.
- Disable or make the identity or policy dependency unavailable. Confirm that the system denies access rather than silently proceeding.
- Review audit records to verify that the decision and relevant source provenance can be investigated without exposing protected content to unauthorized users.
Operational checklist before launch
- Source repositories have named owners, reviewed memberships, corrected sharing, and secure defaults.
- Each request is associated with an authenticated identity, and authorization is evaluated using trusted identity and policy data.
- Permission and classification metadata are captured at ingestion and maintained when source content or access changes.
- Retrieval is filtered before text enters model context, with a defined deny-by-default response for failures.
- Sensitive content is classified, minimized, and excluded or protected according to handling requirements.
- Encryption, service-role scope, network controls, DLP, retention, and audit are configured for the selected data path.
- Tests cover both allowed and denied access, permission changes, deletions, edge cases, and prompt injection in retrieved material.
- The selected product’s connector behavior, identity flow, license, region, and contractual terms have been checked rather than assumed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
