Before you approve a shared AI knowledge assistant, ask the vendor to demonstrate a revocation. Let a test user retrieve a document, remove that user's access in the source system, and ask again. The second request reveals something a successful first login cannot: whether the assistant is enforcing current permissions or an older copy.

AWS described a two-stage approach for Amazon Quick and Bedrock knowledge bases on October 7. An index first filters relevant candidates; the source system then verifies current document access before approved passages reach the model. The operational issue is the interval between a permission change and the next retrieval, not simply whether the application knows who signed in.

A correct identity can meet an outdated access list

Retrieval-augmented generation systems make documents searchable by storing indexed passages. Permissions may be copied into that index during synchronization. This is convenient because the system can narrow results without checking every document at its original location. It also means the index describes access at a particular moment.

A project ends, an employee changes territory, or a distributor leaves a collaboration. The source document may not change at all, yet the list of permitted readers does. If retrieval continues to rely on the previous list, a correctly authenticated user can receive information that the source system would now refuse to show. Authentication is working; the authorization evidence is stale.

For international sales operations, this matters when pricing documents, account-specific correspondence or partner files are shared across teams. It is not a reason to avoid searchable knowledge altogether. It is a reason to distinguish public product information from material whose permitted audience changes with a commercial relationship.

Our earlier article on preserving the requester's authorization context addresses whose authority follows a request. Revocation adds a time dimension. Knowing the right user does not establish that yesterday's permission is still valid today. Both questions need answers before a private document is supplied to the model.

Test the transition, including the existing conversation

An initial role test usually asks whether one department can see another department's files. Keep that test, but add a transition test. Use a harmless test document, confirm permitted access, revoke it at the authoritative source and repeat the query. Record what happens in a new session as well as the conversation that already retrieved the material.

The existing conversation raises an important limitation. A permission check on new retrieval cannot necessarily erase content already present in the conversation. Ask how the product handles stored context, references and attachments after access changes. Do not accept a successful fresh-session test as proof that every previous output has been withdrawn.

Check file downloads too. An assistant may refuse to quote a passage while still exposing a usable attachment link. Conversely, a link may lead to the source system's own permission check. These are different implementations with different consequences. The vendor should be able to show the behavior rather than describe it with a general promise of enterprise security.

Chinese exporters supplying documentation to overseas partners can apply the same test before broadening a shared portal. Start with project files whose audience is easy to define. Public manuals can remain public; account-specific material should not inherit that openness merely because both types appear in one search interface.

Decide what happens when permission cannot be checked

A live check introduces a dependency on the source system. If it is temporarily unavailable, the assistant needs a defined response. For sensitive project material, returning no content until access can be confirmed is a different and safer choice than assuming a cached permission still applies. Public information may justify another policy, provided the classification is explicit.

Checking every document individually would also create unnecessary work. Candidate filtering followed by current checks concentrates that work on the files relevant to the request. The tradeoff is therefore not simply speed versus protection. It is where the application spends checking effort and whether that check occurs before private information enters the generation context.

A prompt telling the model not to disclose confidential information comes too late if the unauthorized passage has already been supplied. The application should exclude the passage before that handoff. The model's choice of wording cannot repair an access decision that admitted the wrong data.

Finally, distinguish future access from copies already released. Revocation can prevent later retrieval; it does not automatically recall an exported file, screenshot or email. A sound rollout therefore considers both the retrieval boundary and the allowed output channels. The useful purchasing question is not whether a product has an access-control feature, but what remains readable after a real permission change.

Sources