AWS details live document-permission checks for RAG in Amazon Quick and Bedrock Knowledge Bases

In an October 7 article, AWS explains how Amazon Quick and Amazon Bedrock Knowledge Bases address the complex permissions attached to enterprise RAG sources. The approach combines ACL filtering already stored in an index with a live permission check against the authoritative source at query time, adding a security layer to pre-retrieval filtering.

In the Amazon Quick Google Drive example, Stage 1 searches a vector index and uses its stored ACLs to identify candidate documents. Stage 2 checks those candidates in real time through Google Drive APIs. Amazon Quick uses administrator-provided service account credentials to generate user-specific access tokens through impersonation.

The check determines what can enter the generation flow: documents the user cannot access are excluded, and only verified, authorized passages are passed to the LLM as context. AWS says revoked access is reflected in AI responses within moments rather than hours or days when using a RAG product. Amazon Bedrock also provides Guardrails, grounding checks, and configurable safety policies.

AWS says Mondelēz International has deployed Amazon Quick for more than 35,000 employees across four regions. The example adds a document-level RAG access-control angle to AWS's October 1 account of Amazon Quick querying governed Quick Sight datasets in real time, where queries run as the app viewer and apply that reader's row- and column-level security.