RESEARCH / ENTERPRISE AI

Permissions built into retrieval

Explains how document permissions and metadata travel from source systems into retrieval, so answers, citations and connector searches respect user access and changes to permissions can be traced.

Read on this page

At a glance

An AI assistant can make company information easier to find, which makes correct access control essential. This paper explains how Corporate GPT carries document permissions and provenance from its source systems into the search index and applies them when a person asks a question.

The design links user identity, groups, projects and document-level access lists to the material returned by retrieval. It also describes how permission changes are synchronised and how metadata supports citations, document structure and filtering. For teams assessing enterprise AI governance, the paper makes the path of a permission change visible and distinguishes the authoritative permission record from the search index that follows it. It closes with known implementation gaps and planned hardening work.

What the paper covers

  1. Document permissions travel with indexed content and constrain retrieval queries.

  2. The permission source of truth is kept separate from its searchable index copy.

  3. Provenance and structural metadata support citations as well as governance checks.

Research context

The paper describes the current design alongside known limitations and a hardening roadmap. It should not be read as proof of complete connector parity or instantaneous permission updates in every deployment; source integration, synchronisation and failure handling require deployment-specific verification.

THE ORIGINAL WHITEPAPER

Read it here.

Download PDF

The complete paper, with its original figures, tables and references.

26 pages · Read without leaving this page
FROM RESEARCH TO YOUR WORK

Bring your questions.

Discuss the approach, evidence and relevance to your team with the people building it.

Discuss this research