Amazon Quick adds real-time permission checks to AI search

Retrieval Augmented Generation, the technique of letting an AI assistant pull passages from company documents before answering, has become a common way for enterprises to mine knowledge held in Microsoft SharePoint, Google Drive, and Atlassian Confluence. The catch the post highlights is that those same sources are governed by layered permission structures — inheritance hierarchies, group memberships, conditional access policies, and deny rules — that differ from one product to the next.

The prior standard relied on data connectors that copied permission lists during scheduled syncs and stored them as index attributes, then matched the logged-in user against those stored attributes at query time. The post argues this leaves three openings: the AI system becomes the enforcer without being the authoritative source, permission lists go stale between syncs, and new permission features in a source can create mapping gaps until a connector is updated.

The AWS answer is a hybrid: cached permission lists still drive the initial semantic search for speed, then a second stage calls the source directly to confirm the user may see each candidate document. If this holds up across many connectors and large document volumes, the appeal for security and compliance reviewers is clear — but the benefit depends on the real-time check staying fast and accurate at scale, and on connectors keeping pace as each source's permission model changes.