Your organization’s access policy should decide which documents an AI assistant can read. Apply that policy in the retrieval service before any text reaches the model. The model can then summarize or cite the material the employee is entitled to see.
Consider an account manager asking, “What did we agree to renew next quarter?” A general account file may contain renewal dates and notice periods. A restricted finance addendum may contain negotiated rebates. Two employees can ask the same question and receive different answers because their source permissions differ. The connector may need broad access to index the library, but every search should use the signed-in employee’s effective permissions.
What Privacy Conductor found
In the October 2026 preprint Privacy Conductor, Ryan Thornton and colleagues used a deterministic gate to apply human-authored rules. The design draws on contextual integrity, the idea that an appropriate disclosure depends on who is involved, what information moves and the conditions under which it moves. A clinician’s role, for example, can be necessary for access while a specific assignment determines which patient’s record the clinician can receive.
With the authored labels, the gate matched its specified policy on all 2,520 requester–document combinations across 105 synthetic clinical documents. The researchers then held the gate fixed and substituted model-generated labels. Across seven configurations, sensitivity tiers matched the authored labels on 78% to 86% of documents, while exact access-control lists matched on 23% to 80%. In that labeling run, every configuration produced both unauthorized releases and blocked legitimate requests.
A sensitivity tier describes the document. An access-control list records who can receive it. A model may correctly recognize a contract as confidential while missing that only the assigned legal team and two finance roles have access. A policy check can apply its inputs consistently and still deliver the wrong result if the inputs carry the wrong permissions.
The study’s main evaluation used one synthetic clinical corpus and an authored reference policy. It assumed non-adversarial participants and did not measure retrieval ranking. The result establishes how the gate behaved under those conditions. Your team still needs to test its own repositories, identities and downstream delivery paths.
Build permission checks into the search request
Resolve the requester. Bind the request to the signed-in user and tenant. Resolve group membership and relevant conditions through your identity provider and source systems. For searches across multiple repositories, document which system owns each grant and what the assistant does if a source cannot confirm it.
Filter before delivery to the model. Carry the source document ID and policy information into each indexed passage. Use source-backed authorization to constrain retrieval or filter candidates inside the trusted retrieval service before they reach the model. Include titles, snippets and citation links in that decision. Let the model propose descriptive tags for review while the document owner or delegated administrator controls access grants.
Keep permissions attached when content is reused. Permission changes need a defined propagation window. Scope caches to the identities and policy state they serve, and recheck access before using a cached passage in a new answer. Keep access-decision logs useful for audit with document IDs, policy versions and outcomes. Apply separate access and retention controls to any traces that contain source text.
Check the delivery audience. Sharing a document summary with a team channel or email recipient requires a separate authorization check. Verify the audience before delivery. Decide how the system handles a destination whose audience it cannot verify.
Five tests to run before broadening access
Start with one repository and controlled test documents. Have the document owner write the expected outcomes before the pilot. Run both allowed and denied cases so you can see where the assistant blocks useful work as well as where it exposes restricted content.
Same question, different access
Using two test accounts with different approved access, ask for the same contract. Confirm that only the permitted account receives the restricted content and that the other receives an answer grounded in the records it can read.
A permission changes
Remove a test user’s group membership and measure how long revocation takes across fresh queries and follow-ups. Check search results, citations and reused context against the same revocation deadline. Previously delivered information may still be visible to its recipient.
The permission service is unavailable
Exercise the outage behavior in staging. Require the assistant to withhold affected records until it can confirm access, and verify that operations can distinguish an authorization error from a normal empty search.
A document moves or disappears
Move a test document to a more restricted library, then delete it. Verify that indexed passages, previews and links honor the new scope and stop appearing after the documented deletion window.
The answer leaves the chat
Send a permitted test summary through a supported sharing path. Verify recipient access at delivery and check that restricted source text stays out of unauthorized exports and diagnostic logs.
Give every test a named owner and a release decision. Treat a confirmed unauthorized disclosure as a release blocker. Track incorrect denials separately, with examples of which tasks they prevent. Re-run the checks after connector changes, permission mapping updates and new sharing features. The AI agent boundary testing guide explains how to retain those cases as regression tests.
