Can AI Search Respect Access Controls? A Practical RBAC Guide [2026]

The question security teams ask first

Before rolling out AI search, most security and IT leaders ask the same thing: if we connect Slack, Google Drive, Jira and GitHub, can an employee get an answer built from a document they aren't allowed to open?

It's a fair worry. An AI assistant doesn't show you a list of files you can or can't click. It reads content and writes an answer. If restricted content gets into the model's input, it can come out in that answer, even when the user never sees the original document.

Where permission leaks come from

Most leaks fall into three patterns:

1. Filtering after retrieval. A simple retrieval-augmented generation (RAG) setup indexes everything into one store, finds the closest matches to a question, and only then removes what the user can't see. If that filter is skipped, buggy, or applied after the content is already in the prompt, restricted text can reach the model.

2. Stale permissions. Permissions change constantly. People leave private channels, change teams and leave the company. If the AI system's copy of permissions is refreshed slowly, there is a window where someone can still get answers from content they've lost access to.

3. Over-broad connector accounts. If a connector reads everything with an admin account and the system doesn't record which individual users can see each item, it has no reliable way to filter per person.

Embeddings themselves don't carry permissions. That isn't a flaw in vector search; it means access information has to be stored and enforced alongside the content.

What a permission-aware design looks like

A sound design generally includes:

• Per-item access data. Each indexed message, ticket, document or file records who can see it in the source tool, by user and by group.
• Filtering before retrieval. The system narrows the search to content the asking user can see before anything is passed to the model.
• Prompt-time enforcement for agents too. The same rules apply when an AI agent or an MCP client queries on a user's behalf.
• Fast permission updates. Changes in the source tool, especially removals, are picked up quickly. Ask vendors how quickly, and how they handle deleted content.
• Sources on every answer. Linking each answer to the documents it used lets people check what it was based on and helps reviewers spot anything that shouldn't be there.

What filtering doesn't solve: prompt injection

Filtering before retrieval limits what an injected instruction can expose, because restricted content never reaches the model. It doesn't stop prompt injection itself. A malicious instruction can still arrive inside content the user is allowed to see, such as a shared document or a ticket comment. Treat injection as a separate risk, with its own controls and testing.

How Memora handles access

Memora follows the permissions already set in each connected tool. Answers only draw on content the person asking can already open in Slack, GitHub, Jira, Google Drive and the other tools you connect, and every answer links to its sources so you can see what it was based on.

On data handling: content is encrypted at rest (AES-256) and in transit (TLS 1.3), customer content is never used to train AI models, and language-model requests go to an OpenAI Enterprise endpoint with zero data retention. Memora runs on AWS in the USA and EU, and the Enterprise plan includes dedicated single-tenant infrastructure.

Memora does not hold SOC 2, ISO 27001 or HIPAA certification today. We share our security documentation and a DPA on request. Details are on the security page.

How to test any AI search vendor

Don't rely on architecture diagrams, including ours. Test with your own data:

1. Create a restricted item. Put a distinctive, made-up fact in a private Slack channel or a restricted document.
2. Ask as an outsider. Ask a user who isn't in that channel a question that would require the fact. They shouldn't get it, or any paraphrase of it.
3. Remove access and re-test. Take a user out of the channel, note the time, and ask again until the fact stops appearing. That tells you the real sync delay.
4. Delete content and re-test. Delete the item and check how long answers keep using it.
5. Test agents and MCP access the same way, since agent queries sometimes take a different path.
6. Ask for documentation. Request the vendor's security documentation, data processing agreement and any third-party audit reports, and check which subprocessors receive your data.

Frequently asked questions

Can AI search respect access controls? Yes, when permissions are stored with the content, enforced before retrieval and kept in sync with the source tools. Test it with your own data rather than relying on a vendor's claims.

How does role-based access control work in AI search? The system identifies the user, works out which items they can see in each connected tool, and limits retrieval to those items before anything is passed to the language model.

What happens when someone is removed from a private Slack channel? In a permission-aware system, they should stop getting answers from that channel once the change syncs. How long that takes varies by vendor, so measure it during evaluation.

Does pre-retrieval filtering prevent prompt injection? It limits what an injection can expose, because restricted content never reaches the model. It doesn't prevent injection through content the user is allowed to see.

Is Memora SOC 2, HIPAA or GDPR certified? Memora doesn't hold SOC 2, ISO 27001 or HIPAA certification today. We share our security documentation, current compliance status and a DPA on request via security@memora.company.

Related guides