Three layers decide what an answer may contain: knowledge base grants, source permissions and agent identity.
An agent may only retrieve what the person asking could already open themselves. Everything else follows from this.
Knowledge bases are granted to users, groups, channels and agents. A question from a Slack channel is answered only from the knowledge bases granted to that channel. A question in the web app is answered from the knowledge bases granted to that user.
Every document carries the principals allowed to read it in the source system, synced along with the content:
| Source | Permission boundary |
|---|---|
| Google Drive | File and folder sharing, including groups and "anyone in the organisation" links |
| SharePoint / OneDrive | Site, library, folder and item permissions; Entra ID groups |
| Notion | Page and teamspace sharing |
| Confluence | Space permissions and page restrictions |
| Slack / Teams | Channel membership; private channels only for members |
| Gmail / Outlook shared mailboxes | Mailbox delegation |
| Zendesk, Intercom, HubSpot, Salesforce | Role/profile-based object and field access |
| Databases | The view or table you connect; restrict with a database view if needed |
The filter is applied inside the retrieval query, before ranking. If the answer exists only in documents the asker can't open, the agent says it can't find the answer.
An agent has its own identity with explicitly granted knowledge bases and tools. When it acts on behalf of a person (answering their question), the intersection of the agent's grants and the person's permissions applies. When it runs on a schedule, only its own grants apply — so grant agents the minimum they need.
"Anyone in the organisation" sharing is honoured as such: those documents are visible to every workspace user. Administrators can exclude specific sources from company-wide scope under Source → Permissions → Treat org-wide links as restricted.
Knowledge → Permissions check lets an admin enter a user's email and a document and see whether — and why — that user can retrieve it.