Start with a question about access
Which documents should a particular employee be able to use for this task? That is a better starting point than connecting every folder. Write down the audience, the source owner and the permitted uses. Separate company-wide guidance from client records, commercial negotiations and staff information. Resolve ambiguous sharing rules before importing content.
Signing in establishes identity; it does not grant access to every document. OWASP recommends minimum necessary permissions, denying access by default and checking permission on every request. For an AI assistant, apply those principles to retrieval and supporting features, not just the chat login screen.
Follow one project question through the system
Illustrative example, not a Fewzen client result: a consultancy keeps delivery notes and commercial negotiations in separate project folders. A delivery coordinator asks the assistant what changed this week. They can read the delivery notes but cannot read the negotiation folder.
The assistant should assemble the answer from permitted notes. It should not fetch both folders and then ask the model to hide confidential details. By that stage, restricted material has already entered the answer-generation process. Nor should a citation expose the title of a restricted negotiation document.
Give the coordinator a useful answer within the available evidence. Explain that the answer covers accessible sources without revealing the existence or contents of restricted records. A director may legitimately receive a different answer to the same question.
Make the application enforce the boundary
Use the authenticated user’s identity and verified group membership when requesting documents. Do not let a chat instruction such as “I am the finance director” choose the permissions. Keep the access decision in trusted application or platform controls, separate from the model’s interpretation of the question.
Microsoft documents an Azure AI Search pattern that filters results using user or group identifiers. It also explains that these identifiers are strings in a filter, not authentication by themselves. The surrounding application must supply trustworthy identity information and apply the filter consistently.
Ask the supplier to show the actual retrieval request for two users with different access. A policy statement or a prompt saying “respect permissions” does not demonstrate that the integration enforces the rule.
Keep permissions attached to imported content
Search systems often copy documents into an index and divide them into smaller passages. Your design needs a dependable relationship between each passage, its original document and its access rules. A connector account that can read a whole drive is not evidence that every assistant user should see it.
Google’s Gemini Enterprise guidance for custom Cloud Storage and BigQuery sources describes identity-provider integration, access-controlled data stores and document permission metadata. The setup is explicit. Uploading content alone is not the same as configuring document access.
For your chosen connector, ask which permission types it supports and which it cannot represent. Check guest access, shared links and inherited folder rules against your actual usage. Keep unsupported material outside the pilot rather than inventing a weaker permission model to make the import work.
Agree what happens when access changes
People change projects, contractors leave and documents move. Decide how quickly those changes must affect the assistant. Record the acceptable delay, the refresh mechanism and the response when synchronisation fails. A successful initial import does not establish that tomorrow’s permissions will be correct.
Microsoft’s Azure AI Search overview states that native query-time checks use permission metadata already synchronised into the index. Source permission changes depend on the documented refresh mechanism. The page also marks several native access-control capabilities as preview. These details were checked on 30 October 2026; verify the specific source and feature before selecting a production approach.
If your process requires faster revocation than a connector can provide, choose another approach or limit the content it handles. Agree how an operator can temporarily disable a source while an access problem is investigated.
Include answers, history and exports in the design
The source document is only one place information can appear. An answer may be saved in chat history, cached for reuse, exported or posted into a shared channel. Decide who can open each of those copies. Do not reuse one person’s answer for another person without considering the supporting documents and current permissions.
Treat this as a design review for your proposed workflow, not a claim that every platform behaves the same way. Ask what happens when someone reopens an old conversation after losing project access. Check whether shared transcripts retain confidential excerpts or citations.
Revocation cannot make a person forget information they already saw or remove every copy they downloaded. Set realistic boundaries and explain them to the source owners. Avoid recording full document passages in operational logs when identifiers and redacted diagnostics are enough.
Ask for a small, repeatable demonstration
Use synthetic documents with recognisable test phrases and accounts representing real access groups. Agree expected results before testing. Check the retrieved material, answer text, citations and exports. Include a permitted question so that a system which blocks everything cannot appear to pass.
- Ask two users the same question. Confirm that each answer uses only their permitted documents.
- Try a direct document identifier and a question that claims a more privileged role. Confirm that neither changes access.
- Remove a user from a project. Repeat the question after the agreed refresh window and reopen saved conversations.
- Move a document into a restricted folder. Check its indexed passages and any cached answers.
- Interrupt permission synchronisation. Confirm the agreed restricted behaviour and an actionable operator alert.
- Share an answer with a less privileged colleague. Confirm that the sharing rules match the intended audience.
Choose one useful collection first
Start with a collection whose owner can explain its permissions and whose users can judge answer quality. Measure whether people find useful answers, whether references support them and how often missing access needs investigation. Keep a route to the source owner for legitimate access requests.
Permission-aware retrieval adds integration and maintenance work. It does not fix inaccurate documents, guarantee a correct answer or replace broader security review. A smaller assistant using well-managed material can be more useful than a company-wide search whose boundaries nobody can explain.