Permissions in AI search: So that everyone can only find what they are allowed to see

An AI search in the company must comply with the same permissions as storage and network drive. This can be achieved if every section of text in the vector database has the rights of its source document as metadata and every search is filtered for the logged in user – before the language model responds, not afterwards.

The biggest concern about an AI search is justified: If someone asks "What does my colleague earn?", the answer must not come from the payroll. This article shows how to solve this in a technically clean way.

Why the problem arises

In retrieval-augmented generation (RAG), documents are broken down into sections and stored in a vector database. Without further action, this is a large, common pot. The search finds the most suitable section – regardless of which folder it comes from. The language model itself has no rights; it only formulates what is handed over to it.

The principle: right-wingers migrate with them

1. When importing: For each document, the authorized users or groups are read from the source system, such as Paperless-ngx, Nextcloud or the network drive.
2. When saving: Each section gets these rights as metadata, e.g. "Groups: Human Resources, Management".
3. When searching: the application knows the logged in user and his groups and sends a filter: only sections whose groups match the user's groups.
4. For changes: If rights are changed in the source system, this is added to the vector database.

Vector databases such as Qdrant support such filters on metadata directly in the search. With other solutions, it must be checked whether strict filters still provide enough hits – the article Qdrant or pgvector explains the difference.

Typical mistakes

Simple solution to get started

Not every company needs rights per document. It is often sufficient to create separate knowledge collections according to confidentiality – general, sales, personnel, management – and assign them to groups. In Open WebUI, this can be done via groups and authorizations per collection. Finer rights are worthwhile if documents are automatically transferred from an archive.

Data protection and proof

What counts for the GDPR is that only authorized persons see personal data. Document how rights are taken over and checked, and test with accounts from different groups. You can find out more about data protection in AI searches in the article AI document search and GDPR.

Our AI document search takes over rights from the source system and filters for the logged in user in Qdrant before each response.

Counselling and accompanied implementation is eligible for funding: Through INQA coaching, the federal government covers 80% of the consulting costs of up to €1,200 per day for up to 12 days, i.e. up to €11,520 subsidy. In Mecklenburg-Western Pomerania and the other new federal states, BAFA consulting funding is also eligible at 80% until 31.12.2026 (50% in the old federal states). Funding is provided for consulting, not software. The funding check shows which program fits.

Frequently Asked Questions

Can an AI search respect access rights?

Yes, if the rights of the source documents are stored as metadata and filtered for the logged-in user each time they search.

Does ChatGPT know my folder rights?

No. A language model knows no rights. The application around it must ensure that only permitted content is passed to the model.

What happens when rights change?

A regular comparison with the source system transfers changed rights to the vector database. The frequency depends on how quickly changes have to take effect.

Are separate collections of knowledge enough?

For starters, often yes. Finer rights per document are worthwhile if large archives are automatically integrated.

Would you like to build an AI search with clean rights? Talk to us via the contact page.