Enterprise organizations are adopting Retrieval Augmented Generation (RAG) to unlock insights from company knowledge sources like Microsoft SharePoint, Google Drive, and Atlassian Confluence. However, these knowledge sources contain sensitive information governed by complex permission structures. Making sure that AI-generated answers respect those permissions is one of the hardest challenges in enterprise AI.

In this post, we explore how Amazon Quick and Amazon Bedrock Knowledge Bases solve this challenge through real-time access control list (ACL) enforcement, verifying permissions directly with authoritative sources at query time.

The business problem

Consider this scenario: A SharePoint site owner creates a knowledge base for their organization. Team members across multiple departments use an AI assistant to get answers from this knowledge base. The critical requirement is that each team member must only receive AI-generated insights from documents they’re authorized to access.

This is a universal enterprise challenge. Organizations want to democratize access to AI-powered insights without compromising their existing security posture. A single unauthorized document surfaced in an AI response could expose confidential strategy documents, unreleased financial data, or sensitive HR information.