A revoked permission can remain useful to an AI assistant long after it has stopped opening a file in the original application. If a retrieval index still recognizes yesterday’s group membership, a question can bring that document into the model’s context. The user need not know the file exists: a summary or comparison may disclose part of it.
Amazon Quick’s October 7, 2026 announcement addresses that interval by checking selected documents against their source before generation. AWS combines indexed access-control lists, or ACLs, with a second, live decision. This changes who has the final say about document access, but it does not make every Bedrock knowledge base live-verified or turn retrieval filtering into user authentication.
Two gates between search and the model
The usual ingestion pipeline copies documents and permissions into a search index. At query time, semantic relevance and stored ACL metadata determine which passages are returned. It is efficient, but the permission snapshot reflects the last successful synchronization, not necessarily the source’s current state.
Quick retains that fast first stage. It searches for relevant passages and filters them using indexed ACLs, then validates the reduced candidate set through the source API. A candidate that fails the live check is discarded even when its indexed permissions still allow access. Only passages passing both stages enter the language model’s context.
This is query-time verification of selected documents, not continuous synchronization of every permission in the repository. Checking fewer candidates controls remote-request volume and latency. The initial index still affects which documents become candidates, so a final live check does not by itself fix every retrieval omission.
AWS’s Google Drive example uses administrator-provided service-account credentials to obtain user-specific access tokens through impersonation. Drive remains authoritative for the candidate’s current permissions. The Quick identity must therefore map correctly to the user recognized by Google Workspace; delegation credentials, token handling and administrative privileges become security-sensitive parts of the retrieval path.
SharePoint uses a different identity flow. For an ACL-enabled knowledge base, Quick prompts the user to sign in when protected content becomes relevant, then uses delegated access to validate candidate documents. AWS describes this as generally a one-time sign-in, with an associated refresh token lasting about 90 days—not a statement that every access token lasts 90 days.
The delegated scopes include reading site items and files, the user’s basic profile and maintaining authorized access. The administrator-managed ingestion application can separately require directory and group reads and access to selected or broader SharePoint sites. Those are different applications and responsibilities; approval for ingestion should not be confused with the user-delegated verification path.
SharePoint also has a consequential setup constraint: ACL management must be enabled when the knowledge base is created and cannot be changed afterward. Omitting it means creating another knowledge base, with implications for reindexing, rollout and acceptance testing.
Why a copied permission is not always enough
Enterprise permissions are not a single flat list. SharePoint combines sites, groups, inheritance and exceptions; Drive combines personal files, shared drives, direct shares, groups and organization-wide settings. Confluence adds spaces, page restrictions and inherited access. Translating all of that into one index creates both mapping and freshness risks.
A worker removed from a confidential strategy group just after a crawl may remain authorized in the copied metadata until another successful synchronization. Event-driven updates shorten some gaps but cannot respond to events they never receive. AWS specifically notes that some Confluence group-membership changes do not always produce usable events. New sharing mechanisms can also outpace a connector’s interpretation.
RAG makes these discrepancies more consequential because it combines passages across repositories. Public project updates can be synthesized with a restricted budget or personnel decision. Filtering the answer afterward is a weak substitute: the model has already received the information. Citations, follow-up questions, exports and agent-triggered actions need the same before-generation boundary.
Live source decisions reduce dependence on correctly reconstructing every permission rule in the index. They cannot repair an overbroad grant in the source itself. A confidential file in a widely shared folder still passes its actual access policy. Least privilege, repository ownership, access reviews and offboarding remain necessary.
Nor does an allowed document become trustworthy content. It can contain malicious instructions aimed at the assistant. Bedrock Guardrails, grounding checks, safety policies and tool restrictions address different risks; none automatically understands an organization’s document-access rules, and correct ACLs do not eliminate indirect prompt injection.
Connector coverage is narrower than a product label
Quick documents integrations with S3, Confluence, Google Drive, OneDrive, SharePoint and authenticated web content, using different OAuth and service-account patterns. Integration availability is not proof that every connector and configuration performs the same live check. The announcement emphasizes SharePoint, Drive and Confluence, while its detailed flows focus on Drive and SharePoint.
Administrator-managed, user-managed and custom configurations therefore need separate treatment. A supported source name alone cannot establish which identity is used, whether verification is live or indexed, or how its errors affect retrieval.
Bedrock’s custom data-source documentation makes the distinction explicit. These sources use customer-provided ACL metadata rather than live source verification. Applications attach allow and deny entries to documents; filtering occurs before retrieval and deny overrides allow. Their accuracy and freshness depend on the customer’s ingestion process. If a custom connector defines the permissions itself, there may be no authoritative source API for Bedrock to consult.
The documentation also warns that ACL-aware filtering is not an authentication boundary. Bedrock cannot verify the identity context supplied by the calling application. That application must authenticate users upstream and pass verified identity information. A reliable policy lookup against a forged or mistaken user identifier can still produce an unsafe result.
Custom-source failures can also look like missing knowledge rather than a security error. Incorrect ACL field casing, missing lists or a mismatched user email can silently exclude documents. AWS describes fail-closed retrieval in these cases, without an authorization exception. That documented behavior should not be generalized into an unverified claim about every connector’s handling of every outage.
Freshness introduces operational dependencies
AWS says source verification can reflect revocations in moments instead of waiting hours or days for synchronization. That is a company claim, not an independently measured service-level guarantee. Results depend on the source platform, token state, API availability, connector configuration and knowledge-base mode.
Remote APIs can throttle requests, fail transiently or go offline; consent can be withdrawn and tokens can expire. Excluding a document when permission is uncertain is the secure default, but it can leave an authorized user with an incomplete answer. A system that avoids leaks by routinely omitting legitimate evidence can still fail as a knowledge product.
The added calls also create a performance trade-off. Parallel checks reduce waiting but increase request bursts; sequential checks limit concurrency but add latency. Caching a successful decision can improve speed while reintroducing a freshness interval. The public account does not establish every cache, timeout, retry or rate-limit policy, nor comparative leakage rates, latency, API overhead or outage benchmarks.
Operational evidence must connect the answer to its source checks: the identity presented, verification result and exclusion reason, without exposing sensitive document names in diagnostic messages. Separating absent content, failed retrieval and denied access is important for both incident response and ordinary support.
AWS offers a customer signal rather than an independent security test. It says Mondelēz International deployed Quick for more than 35,000 employees across four regions. Senior M365 innovation specialist Jamahl Wiggins says live access control helped satisfy security and compliance reviewers. That indicates demand and organizational acceptance, not measured proof of leakage prevention or performance under all conditions.
AWS’s Generative AI Lens already warns that reconstructing complex ACLs through metadata introduces engineering work and potential permission gaps. Query-time verification addresses part of that problem, while custom implementations retain more responsibility. The same distinction between personal and shared information also matters in an AI knowledge base: a common interface does not erase the boundaries of its connected information.
The decision moves, but responsibility does not disappear
A representative deployment needs evidence across the complete login-to-answer path: revoked access, group and inherited changes, explicit denies, expired tokens, API failure and knowledge-base recreation. Authorization accuracy matters alongside retrieval completeness, added latency, renewal failures, throttling and unanswered questions caused by verification.
There are alternatives: carefully synchronized ACLs, separate indexes for security domains, native permission-aware enterprise search, or additional source calls. Each trades freshness, operational complexity, retrieval flexibility and external dependencies differently. Query-time authorization could become a procurement baseline, but this announcement does not establish that it already is one.
Quick’s contribution is a specific architectural improvement: where supported and correctly configured, the source gets a final permission decision before text reaches the model. Its practical strength depends on connector-specific guarantees and observable failure behavior—not on treating “ACL support” as a complete security system.
Sources and related reading
AWS announcement; canonical announcement address; SharePoint ACL configuration; Quick data-access integrations; related reading on personal and team knowledge bases; Bedrock custom-source ACLs; AWS Generative AI Lens.