Corporate knowledge is not equally accessible to all employees. Personnel files, contracts, technical documentation, and executive board documents are subject to different access rights—according to the “need-to-know” principle, each person sees only what they need for their specific task.
If two employees ask an internal AI assistant the same question, the correct answer may therefore differ.
Example: “What does our staffing plan look like for the coming year?”
The department head is authorized to access the relevant planning documents. Her colleague in sales is not. If the AI finds the confidential planning document during its search, the document may only be used to generate the response for the department head. The colleague receives a response without this content—and without any hints that would allow him to infer the existence of the document.
The key rule is: The AI may only provide a user with information that this user would be permitted to access even without the AI.
Many companies rely on Retrieval Augmented Generation (RAG) for internal AI applications. In this process, the system retrieves relevant information from the organization's data sources and provides it to a language model as context. This significantly improves the quality of AI responses.
However, a RAG system does not automatically enforce access permissions.
If the retrieval process does not take existing access rights into account, even a technically sound system will use information that the user making the query is not authorized to see. The language model cannot correct this: Once information is included in the context, it can be incorporated into the response. An instruction in the prompt such as “Do not disclose confidential information” is not an access control measure.
That is why authorization checks must take place before information is passed on to the language model. This is precisely where Enterprise Search becomes the foundation for secure Enterprise AI.
Enterprise search solutions make information accessible across multiple data sources while enforcing existing access permissions. This logic can be applied to generative AI.
The retrieval layer determines which information is relevant to a query and which of that information the respective user is actually permitted to see. Only then is authorized content passed to the language model as context.
This makes Enterprise Search a controlled knowledge layer between corporate data and AI. Search applications, chatbots, AI assistants, and AI agents all access the same permission-aware knowledge base, rather than each application maintaining its own data copies with its own access control logic.
With IntraFind, the iFinder enterprise search solution fulfills this role. The iAssistant builds on this: A question is first sent to the search function, which retrieves relevant passages that the user is authorized to access. Only these passages are provided to the language model, and each response cites its sources.
Whether an AI application reliably adheres to access rights depends on a few key factors:
AI agents do more than just answer questions. They conduct research, use various systems, and perform further actions based on that information. This makes clearly defined access permissions even more important.
In practice, agents often operate using service accounts or API keys that give them access to far more information than an individual user is authorized to access. However, an agent must not view additional information or perform actions simply because it is technically capable of doing so. It must act on behalf of the user—using the user’s permissions, not those of its service account. This also limits the damage if an agent is tricked into taking unintended actions by manipulated content in a document: It still cannot access anything that the user is not already authorized to see.
The principle of least privilege applies: The user’s permissions and the organization’s rules set the boundaries—for every single action taken by an agent.
Access permission checks during retrieval also determine what information a language model is allowed to receive. This is particularly relevant when the model runs outside your own infrastructure: Only content that the requesting user is authorized to view should be sent there.
In this context, digital sovereignty does not automatically mean running every AI system exclusively on-premises. What matters is that the organization itself determines where data is processed, which models are used, and which external services are granted access. Depending on the requirements, on-premises, sovereign cloud, or hybrid architectures are possible.
Generative AI is changing how employees access corporate knowledge. However, this does not change the rules for handling this knowledge. Anyone who is not permitted to open a document is also not permitted to learn its contents via a chatbot. An AI agent must not use information to which the user on whose behalf it is acting does not have access.
That’s why secure enterprise AI doesn’t start with the language model. It starts with data access.
