重新思考 RAG 的访问控制：Amazon Quick 与 Amazon Bedrock
英文标题：Rethinking access control for RAG with Amazon Quick and Amazon Bedrock
企业正通过 RAG 挖掘 SharePoint、Google Drive 和 Confluence 等知识库中的信息，但复杂且频繁变化的权限体系可能让未经授权的内容进入 AI 回答。Amazon Quick 与 Amazon Bedrock Knowledge Bases 采用“两阶段”ACL 机制：先使用索引中的 ACL 进行预检索过滤，再在查询时直接向权威数据源实时验证权限。该方案旨在避免同步延迟、权限映射错误和数据源权限模型演进带来的安全缺口，同时兼顾语义检索性能。Mondelēz International 已在四个区域为超过 35,000 名员工部署 Amazon Quick。
1.3 MB
1.3 MB
2.4 KB
345.0 KB
141.2 KB
346.5 KB
510.7 KB
20.2 KB
23.0 KB
111.7 KB
中文
企业正采用检索增强生成（Retrieval Augmented Generation，RAG），以挖掘 Microsoft SharePoint、Google Drive 和 Atlassian Confluence 等公司知识源中的洞察。然而，这些知识源包含受复杂权限结构管理的敏感信息。确保 AI 生成的回答遵守这些权限，是企业 AI 面临的最棘手挑战之一。
本文将探讨 Amazon Quick 和 Amazon Bedrock Knowledge Bases 如何通过实时访问控制列表（access control list，ACL）执行来解决这一挑战：在查询时直接向权威数据源验证权限。
业务问题
设想以下场景：某个 SharePoint 网站所有者为其组织创建了一个知识库。多个部门的团队成员使用 AI 助手从该知识库中获取答案。关键要求是，每位团队成员只能获得基于其有权访问文档生成的 AI 洞察。
这是一个普遍存在的企业挑战。组织希望普及由 AI 驱动的洞察访问能力，同时又不削弱现有的安全态势。一份未经授权的文档一旦出现在 AI 回答中，就可能泄露机密战略文件、尚未发布的财务数据或敏感的人力资源信息。
为什么现有方法并不够好
RAG 访问控制的一种常见方法，是采用“复制并过滤”（replicate-and-filter）方式执行文档级权限控制。其典型工作方式如下：
- 数据源连接器（例如 SharePoint 连接器）在定期同步任务中拉取 ACL。
- ACL 从数据源复制出来，并作为属性存储在索引中。
- 在查询时，AI 系统将已登录用户映射到已存储的 ACL 属性，并据此过滤结果。
尽管这种方法表面上看似合理，但它存在三项根本性弱点。
问题 1：AI 系统不是事实来源
在这一模型中，AI 系统独自承担权限执行责任，但它并非权限的权威来源。这要求数据连接器能够跨不同数据源，准确复制复杂且因来源而异的 ACL 逻辑。每种数据源都有其独特的权限模型。要在数十个连接器之间映射继承层级、群组成员资格、条件访问策略和拒绝规则，是一项极易出错的工作。
问题 2：过期权限会造成安全缺口
通常，数据连接器支持按需运行或依据客户定义的计划运行的拉取式同步。这些 AI 解决方案中的 ACL，只是上一次同步运行时的时间快照。一些解决方案采用基于事件的更新，但这并不适用于所有场景。例如，Confluence 这类数据源不会在群组成员资格发生变化时发出事件。在两次同步之间，已被撤销访问权限的用户，仍可能从本不应再查看的文档中获得 AI 回答。
问题 3：不断演进的数据源能力
数据源会定期变更或引入新的内容访问控制机制。SharePoint 中新增的权限功能，或 Google Drive 共享模型的变化，都可能使 ACL 映射逻辑出现缺口。在连接器完成更新之前，这可能会导致内容暴露。
AWS 如何解决这一问题：实时 ACL 执行
为解决这些挑战，我们为 Amazon Quick 和 Amazon Bedrock Knowledge Bases 实现了实时 ACL 检查，作为现有检索前 ACL 过滤之上的额外安全层。该机制通过在查询时直接向权威数据源检查权限，确保系统执行的是最新的访问控制，从而避免依赖可能过期或映射错误的 ACL 数据。
架构概览
下图展示了我们的混合方法，它同时提供语义搜索性能和实时安全能力。
图 1：Amazon Quick 和 Amazon Bedrock Knowledge Bases 的实时 ACL 执行架构，结合检索前过滤（阶段 1）与针对权威数据源的实时验证（阶段 2）
工作原理：以 Google Drive 为例
当用户向使用 Google Drive 知识库的 Amazon Quick Agent 提交查询时，系统会分两个阶段执行访问控制：
阶段 1：检索前过滤
Amazon Quick 会针对向量索引执行语义搜索，以找到最相关的文档段落。系统应用已存储在索引中的访问控制列表，由此生成初步的候选文档集。该阶段必不可少，因为在大规模场景下，针对索引中的每份文档发起实时 API 调用的成本过高。
阶段 2：实时验证
Amazon Quick 通过调用 Google Drive API，对候选文档进行实时验证。它使用管理员提供的服务账号凭证，通过模拟（impersonation）生成针对特定用户的访问令牌。Google Drive 维护与每份文档关联的访问控制列表，并作为其事实来源。用户无权访问的文档会从检索结果集中排除。只有经过验证且已获授权的文档段落，才会作为上下文传递给大语言模型（LLM）。模型利用这些知识生成回答。
这种两阶段方法平衡了性能与安全性。它利用缓存的 ACL 提升效率，同时通过实时检查确保正确性。除 ACL 执行外，Amazon Bedrock 还提供负责任 AI 控制措施，包括用于内容过滤的 Amazon Bedrock Guardrails、用于减少幻觉的事实依据检查（grounding checks），以及可配置的安全策略，以帮助组织负责任地部署生成式 AI 应用。
这对您的组织为何重要
该方法带来三项关键优势：
- 始终保持最新的权限 —— 使用 RAG 产品时，不再存在同步周期之间的安全缺口。如果员工的访问权限被撤销，这一变化会在片刻之内反映到 AI 回答中，而不是等待数小时或数天。
- 有信心地扩展规模 —— 无论数据源为何，组织都可以扩展知识库覆盖范围，因为实时 ACL 检查会针对每一次查询向权威来源验证权限。
- 降低运维负担 —— 无需再担心同步频率。
客户如何评价
“当我们着手为组织评估 AI 解决方案时，安全和合规团队明确表示，他们最优先关注的是：确保同事只能看到自己有权访问的信息。这是一项基础要求，但许多平台都难以以有意义的方式解决它。Amazon Quick 的实时访问控制方法明确回答了这一问题，并在整个评估过程中展现出卓越的严谨性。它让我们的内部审查委员会有信心继续推进，也为我们今后思考 AI 治理方式奠定了坚实基础。”
— Jamahl Wiggins，Mondelēz International M365 创新高级专家
Mondelēz International 已在四个区域为其超过 35,000 名员工部署 Amazon Quick。
结论
本文介绍了 Amazon Quick 和 Amazon Bedrock Knowledge Bases 如何通过实时 ACL 执行，解决企业面临的关键安全挑战。双层 ACL 架构会在查询时直接向权威数据源验证权限，确保 AI 生成的回答仅包含用户有权访问的内容。
如需开始使用，请访问 Amazon Quick 和 Amazon Bedrock Knowledge Bases。
关于作者
Amit Choudhary
Amit 是 Amazon Bedrock 和 Amazon Quick 知识库的首席产品经理。他的工作致力于实现以企业知识为基础的安全 AI 交互，改变组织利用自身数据获得 AI 驱动洞察并进行决策的方式。他是从 0 到 1 开创这一实时访问控制功能的产品经理。
Suren Raju
Suren 是 AWS Amazon Quick 服务团队的生成式 AI 专项解决方案架构师，帮助企业构建以自身知识为基础的安全 Agentic AI。他的工作处于 Agent-to-Agent（A2A）编排和 Model Context Protocol（MCP）操作连接器的前沿——这些组件让 AI Agent 能够跨工具进行推理、采取实际操作，并安全调用企业知识，而不只是回答问题。
English / 原文
Enterprise organizations are adopting Retrieval Augmented Generation (RAG) to unlock insights from company knowledge sources like Microsoft SharePoint, Google Drive, and Atlassian Confluence. However, these knowledge sources contain sensitive information governed by complex permission structures. Making sure that AI-generated answers respect those permissions is one of the hardest challenges in enterprise AI.
In this post, we explore how Amazon Quick and Amazon Bedrock Knowledge Bases solve this challenge through real-time access control list (ACL) enforcement, verifying permissions directly with authoritative sources at query time.
The business problem
Consider this scenario: A SharePoint site owner creates a knowledge base for their organization. Team members across multiple departments use an AI assistant to get answers from this knowledge base. The critical requirement is that each team member must only receive AI-generated insights from documents they’re authorized to access.
This is a universal enterprise challenge. Organizations want to democratize access to AI-powered insights without compromising their existing security posture. A single unauthorized document surfaced in an AI response could expose confidential strategy documents, unreleased financial data, or sensitive HR information.
Why existing approaches fall short
A common approach to RAG access control uses a replicate-and-filter approach to enforce document-level permissions. Here’s how it typically works:
- A data source connector (for example, SharePoint connector) pulls ACLs as part of a periodic sync job.
- The ACLs are replicated from the data source and stored as attributes in an index.
- At query time, the AI system maps the logged-in user to the stored ACL attributes and filters results accordingly.
While this approach seems reasonable on the surface, it has three fundamental weaknesses.
Problem 1: The AI system isn’t the source of truth
In this model, the AI system takes sole responsibility for enforcement without being the authoritative source of permissions. This requires data connectors to accurately replicate complex, source-specific ACL logic across various data sources. Each data source has its own unique permission models. Mapping inheritance hierarchies, group memberships, conditional access policies, and deny rules across dozens of connectors is an error-prone undertaking.
Problem 2: Stale permissions create security gaps
In general, data connectors support pull-based syncs that run on demand or on a customer-defined schedule. The ACLs in these AI solutions are a snapshot in time from when the last sync ran. Some solutions use event-based updates, but this doesn’t work universally. For example, a data source like Confluence doesn’t emit an event when group membership changes. Between syncs, a user who had their access revoked might still receive AI answers from documents they should no longer see.
Problem 3: Evolving data source capabilities
Data sources regularly change or introduce new mechanisms to control access to content. A new permission feature in SharePoint or a change to the Google Drive sharing model could create gaps in the ACL mapping logic. This can expose content until the connector is updated.
How AWS solves this: Real-time ACL enforcement
To address these challenges, we implemented real-time ACL checks as an additional layer of security on top of existing pre-retrieval ACL filtering for Amazon Quick and Amazon Bedrock Knowledge Bases. This makes sure the system enforces the most current access controls by checking permissions directly with the authoritative source at query time. This avoids relying on potentially stale or incorrectly mapped ACL data.
Architecture overview
The following diagram illustrates our hybrid approach that delivers both semantic search performance and real-time security capabilities.
Figure 1: Real-time ACL enforcement architecture for Amazon Quick and Amazon Bedrock Knowledge Bases, combining pre-retrieval filtering (Stage 1) with real-time verification against authoritative sources (Stage 2)
How it works: A Google Drive example
When a user submits a query to an Amazon Quick agent that uses a Google Drive knowledge base, the system enforces access controls in two stages:
Stage 1: Pre-retrieval filtering
Amazon Quick performs a semantic search against the vector index to find the most relevant document passages. The system applies access control lists that are already stored in the index. This produces a preliminary set of candidate documents. This stage is necessary because real-time API calls for every document in the index would be too costly at scale.
Stage 2: Real-time verification
Amazon Quick verifies the candidate documents in real time by calling the Google Drive APIs. It uses the service account credential that the administrator provided to generate user-specific access tokens through impersonation. Google Drive maintains the source of truth for access control lists associated with each document. Documents the user is not authorized to access are excluded from the retrieved result set. Only the verified and authorized document passages are passed to the large language model (LLM) as context. The model uses this knowledge to generate a response.
This two-stage approach balances performance with security. It uses cached ACLs for efficiency while facilitating correctness through real-time checks. In addition to ACL enforcement, Amazon Bedrock provides responsible AI controls. These include Amazon Bedrock Guardrails for content filtering, grounding checks to reduce hallucinations, and configurable safety policies to help organizations deploy generative AI applications responsibly.
Why this matters for your organization
This approach delivers three key benefits:
- Always-current permissions – No more security gaps between sync cycles when you are using a RAG product. If an employee’s access is revoked, the change is reflected in AI responses within moments, not hours or days.
- Confidence to scale – Organizations can expand their knowledge base coverage knowing that real-time ACL checks verify permissions with the authoritative source for every query, regardless of data source.
- Reduced operational burden – You don’t need to worry about sync frequency.
What customers are saying about this
“When we set out to evaluate AI solutions for our organization, our security and compliance teams were clear about their top priority: ensuring that colleagues would only ever see information they’re authorized to access. It’s a fundamental requirement, but one that many platforms struggle to address in a meaningful way. Amazon Quick’s approach to real-time access control answered that question definitively and demonstrated a level of rigor that stood out throughout our evaluation. It gave our internal review board the confidence to move forward and set a strong foundation for how we think about AI governance going forward.”
— Jamahl Wiggins, Sr. Specialist – M365 Innovation, Mondelēz International
Mondelēz International has deployed Amazon Quick for their over 35,000 employees across four regions.
Conclusion
In this post, we talked about how Amazon Quick and Amazon Bedrock Knowledge Bases implement real-time ACL enforcement to solve a critical security challenge for enterprises. The dual-layer ACL architecture verifies permissions directly with authoritative sources at query time. This makes sure AI-generated answers include only content a user is authorized to access.
To get started, visit Amazon Quick and Amazon Bedrock Knowledge Bases.
About the authors
Amit Choudhary
Amit is the Principal Product Manager for knowledge bases for Amazon Bedrock and Amazon Quick. His work enables secure AI interactions grounded in enterprise knowledge, transforming how organizations use their data for AI-powered insights and decision-making. He was the product manager who pioneered this real-time access control feature from 0 to 1.
Suren Raju
Suren is a Generative AI Specialist Solutions Architect at AWS on the Amazon Quick service team, where he helps enterprises build secure, agentic AI grounded in their own knowledge. He works at the frontier of agent-to-agent (A2A) orchestration and Model Context Protocol (MCP) action connectors – the pieces that let AI agents reason across tools, take real actions, and securely tap enterprise knowledge rather than just answer questions.