PolarDB:Permission-aware access control

Overview

Document permissions span data ingestion, index construction, and retrieval. Raw files remain in your OSS bucket, and PolarDB only stores derived indexes required for retrieval. Authoritative ACL metadata is stored in the relational database and projected into both keyword indexes and vector indexes to enable permission filtering during retrieval. When the same query is issued by different identities, the system returns only content that the identity is authorized to access.

Knowledge space modes

The knowledge space mode is determined when you create a knowledge space and cannot be changed after creation. When creating a knowledge space in the console, administrators can use the Document ACL toggle to choose whether to enable document-level ACL enforcement.

Recommendation:

• Open space (ACL Disabled) is primarily intended for compatibility with existing data that does not carry permission metadata and for legacy non-permission-aware ingestion and retrieval pipelines. If you do not require direct HTTP access, we do not recommend using this mode as the default for new business spaces.

• For new business spaces, we recommend Permission-aware space (ACL Enforced). Even if the current content is open to all users, you can use public knowledge bases for in-domain sharing while preserving the ability to evolve toward tiered authorization, cross-department collaboration, and compliance governance in the future.

Knowledge base types

Enterprise knowledge space supports public knowledge bases and personal knowledge bases. When creating a knowledge base, the console provides the Knowledge Base Type configuration with Public and Private options. Public corresponds to PUBLIC, and Private corresponds to PERSONAL. The default is Public.

Retrieval requests first pass the knowledge base admission check: public knowledge bases allow access by authorized users in the space, and personal knowledge bases allow access only by the owner. After passing the knowledge base admission check, permission-aware spaces continue to apply document-level ACL filtering, ensuring that users can only recall documents they are authorized to access. Personal knowledge bases can only be created in permission-aware spaces.

Document ingestion and ACL sources

PolarDB determines ACL sources based on the document ingestion method. Administrators do not need to manually pass permission lists for each retrieval. Permission principals are generated from source-side permissions, knowledge base type, or trusted server-side identity context.

Administrators can configure the enterprise identity source in PolarDB Agentic Server and bind identity directories, departments, and users at the knowledge space or knowledge base level. When employees issue retrieval requests through AI agents, the AI agent calls MCP retrieval tools using personal tokens. PolarDB Agentic Server resolves the caller identity, group memberships, and department affiliations, constructs a trusted permission context on the server side, and calls the PolarDB retrieval service. PolarDB returns only content that the current identity is authorized to access.

Permission-aware retrieval mechanism

Permission-aware retrieval uses authoritative ACL metadata combined with permission projection in the retrieval index. Authoritative ACL metadata records document permission ownership and the current effective version. The retrieval index permission projection writes essential permission information such as knowledge base, owner, and readable principals into document chunk indexes, enabling the retrieval stage to filter candidates by permission. A permission-aware retrieval operation includes the following steps:

1. Knowledge base admission: Determine the knowledge bases that the caller can access.

2. Document-level ACL filtering: Match permission principals such as users, groups, and departments, and exclude unauthorized documents.

3. Hybrid recall and ranking: Perform BM25 keyword recall and vector recall on the permission-filtered content, and generate candidate results through score fusion and reranking.

4. Authoritative version verification: Verify the ACL version of candidate documents, remove stale data from ongoing permission updates, and supplement recall as needed.

5. Secure response: Remove internal permission fields and return only the text, file name, page number, heading hierarchy, and other source attribution information.

6. Permission changes: Permission changes are asynchronously synchronized to the retrieval pipeline in the background. During propagation, the system follows a fail-closed policy, temporarily excluding documents whose permissions have not yet been updated to prevent returning potentially unauthorized content. The retrieval service does not need to stop during propagation.

Security guarantees

• Trusted identity sources: User identities are authenticated by the enterprise identity system. Permission principals are generated on the server side in a standardized manner and cannot be forged by clients.

• Server-side permission derivation: Identity resolution, permission context construction, and ACL derivation are all performed on the server side. AI agents cannot bypass these controls.

• Recall-stage filtering: Permission checks are enforced during the retrieval recall stage, not as a supplementary filter after results are returned.

• Permission consistency verification: Authoritative ACL metadata and index projections are kept consistent through version mechanisms. During updates, documents with uncertain permission states are excluded by default.

• Auditable retrieval: Retrieval operations can be logged with caller identity, request time, query content, and returned documents to meet security audit requirements.

• In-domain data processing: Raw documents remain in the customer data domain. Index construction and retrieval are completed within your VPC.

Summary

• Enterprise knowledge space integrates access control as a native capability of enterprise-grade RAG, unifying enterprise identity directories, source-side ACLs, and knowledge base authorization policies into an end-to-end access control system across the knowledge space, knowledge base, and document levels. Permissions remain in effect throughout data ingestion, index construction, and retrieval requests.

• PolarDB Agentic Server serves as a trusted access gateway between the enterprise identity system and AI agents, performing SSO/OIDC identity authentication, organizational relationship resolution, and permission context construction in a unified manner. AI agents do not hold independent data access permissions and always access knowledge services as the current caller, preventing identity forgery and unauthorized access by design.

• With data remaining within the security domain, source-side permission systems faithfully preserved, and agents unable to bypass authorization boundaries, enterprise knowledge space transforms scattered enterprise knowledge assets into governable, searchable, and traceable trusted knowledge services, providing a unified and secure enterprise knowledge infrastructure for employees and AI agents.

For more information about enterprise knowledge permissions and identity integration, see How to integrate enterprise knowledge permissions and identity.