AI search in business software starts with permissions

AI retrieval access control belongs before the model receives a document. If an employee cannot open a source in the business application, the search assistant should not receive its text, summarize it, or reveal its title. A polite refusal after retrieval is too late to serve as the permission boundary.

Before choosing a model, identify the service that decides what this person may read right now. That decision needs to hold even when search results are cached.

Make the application decide the search scope

Derive the tenant and user identity from a verified server session. Resolve their current permissions there, rather than trusting a tenant identifier or role supplied by the browser. The retrieval layer then searches only the authorized scope.

OWASP’s authorization guidance recommends denying access by default and checking permissions on every request. Apply that principle to retrieval requests as well as document downloads.

Each indexed chunk needs a stable source identifier and enough access metadata to enforce the policy. If permissions depend on project membership, an organization-wide filter alone is insufficient. Missing access metadata should make a chunk unavailable, not public.

Where supported, filter candidates inside the search engine. Recheck current source permissions before passing selected text to generation. Filtering only after selecting the highest-ranked results can also leave authorized users with empty answers when inaccessible documents occupy those positions.

Treat revocation as a separate workflow

An index is a copy. Its permissions can lag behind the source application. Define what happens when a person leaves a project, a document changes classification, or an organization closes its account.

There are several surfaces to check:

Surface	Required decision
Search index	How permission changes reach existing chunks
Answer cache	Which user scope and policy version identify an entry
Conversation history	Whether old answers remain visible after revocation
Source links	Whether opening a citation checks current access

If the permission service is unavailable, return an unavailable state. Falling back to an unrestricted index turns a reliability problem into a disclosure problem. Record the denial reason internally without exposing restricted document names to the requester.

A hypothetical project transfer

Suppose a Costa Rican operations team serves two US customers. Ana moves from one customer account to the other. Both accounts have documents titled “Delivery schedule.”

Before the transfer, Ana asks about the first customer’s schedule. After the transfer, she repeats the same question. A cache keyed only by question text would return the old answer. A tenant-aware cache still fails if her project access changed within the same tenant.

The test should inspect retrieved chunk IDs and the model request, not just the final sentence. It should also try the old citation URL. A clean-looking answer does not establish that restricted text stayed out of the generation request.

Require evidence before opening access

Include tests for a guessed source ID, a stale session, revoked membership, and a chunk without permissions. Test background exports and support impersonation too. Administrative convenience often follows a different code path from ordinary search.

Next, draw one retrieval request from session verification to citation download and mark every authorization decision. That map is a useful starting artifact for custom software development, before anyone chooses a vector database or model.