The scariest enterprise RAG failure is not a wrong answer. It is an unauthorized document mixed into a correct-looking answer. One leaked strategy, finance, or HR sentence erases any retrieval win.

On October 7, AWS published the fix as architecture. Real-time ACL enforcement in Amazon Quick and Bedrock Knowledge Bases. Filter first with permission data stored in the search index, then re-check current permissions with the source system. Two stages.

Two-stage permission design where only documents passing index pre-filter and live source verification reach the LLM

That is the whole picture. Fast filters narrow candidates, the source decides truth.

Why the old way leaks: three holes

The common pattern is replicate-and-filter. A connector periodically pulls ACLs into index attributes, then filters by the logged-in user at query time. Reasonable-looking, with three holes.

First, the AI system is not the permission owner. SharePoint, Drive, and Confluence each model permissions differently, so inheritance, groups, conditional policies, and deny rules must be re-mapped per connector. The mapping code becomes the security boundary, and it is easy to get wrong.

Second, the gap between syncs stays open. Connectors run on-demand or scheduled syncs. Some systems like Confluence emit no event on group changes. A revoked user can keep receiving forbidden documents in AI answers until the next sync. Hours or days of exposure.

Third, sources evolve. A new SharePoint permission feature or a Drive sharing-model change leaves mapping logic behind. Exposure lasts until the connector catches up.

So AWS added a live check on top of existing pre-retrieval filtering. Index data serves efficiency, source checks at query time serve correctness.

The two stages: a Drive walkthrough

Take a Quick agent over a Google Drive knowledge base.

Stage 1 is pre-filtering. Run semantic search on the vector index and narrow candidates with stored ACLs. This step is required because live-calling every indexed document would not scale.

Stage 2 is live verification. Using the admin-provided service account, impersonate the user and ask the Drive API. Drive holds the truth. Unauthorized documents drop from retrieval, and only the survivors become LLM context.

User question
  -> Stage 1: index search + stored ACL candidate cut
  -> Stage 2: current permission check on source API
     · allowed goes to LLM context
     · denied drops out, deny beats allow
  -> LLM generates the answer

The hybrid holds performance and security together. Bedrock adds responsible-AI controls like Guardrails and grounding checks around it.

Coverage differs by connector. SharePoint, OneDrive, Google Drive, and Confluence use both pre-filtering and live checks. S3 and Custom treat customer-provided metadata as truth, so no live check exists. Web crawler content has no permission model, so ACLs do not apply.

Failures close shut. Group-resolution, live-check, or internal errors omit the affected documents. A transient fault never turns into unauthorized exposure. Your app must still authenticate users first, with email exactly matching the source. Mismatched mail silently returns nothing. The docs state plainly that ACL awareness is filtering, not authentication.

One field note: 35,000 sets of eyes

AWS quotes Mondelēz. Security and compliance asked first that colleagues only ever see authorized information, a bar many platforms missed. Quick's live access control cleared the internal review, and deployment now covers over 35,000 employees across four regions.

Debugging paths are open too. The September CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs plus the console document-access section show whether a user reaches a document and what the full ACL holds. Use them to split permission faults from other faults.

CodeBridge Mini Lab: replay the moment right after revocation

The briefing's action, directly: test right after taking sharing permission away.

1. One document, two users: one allowed, one revoked
2. Ask right after revocation: a question only that document can answer
3. Confirm: the document leaves both retrieval and the AI answer
4. Edges: deny beats allow, group changes reflect too
5. Faults: slow source APIs still close shut instead of opening

For connectors without live checks like S3 or Custom, document the sync cadence and measure revocation lag separately. Lifecycle issues like reassigned emails must be stopped in the app first.

Retrieval-quality reading continues in the Classic to Agentic RAG post and the failure-analysis post, with internal chatbot design in the internal-docs chatbot post.

Conclusion: RAG security is verification, not filtering

One line to keep:

Index permissions pick candidates, source checks at query time pick what answers may use.

The sync gap cannot be removed, but live checks narrow it. A RAG that fails the right-after-revocation test needs its permission layer fixed before more retrieval tuning. Keeping unseen documents unseen matters as much as accuracy.

Further reading

References

Go deeper with a course

If you want to improve retrieval and generation together, then design permissions, cost, and latency as one system, the path from Classic through Graph to Agentic RAG connects directly to this post's two-stage story.