Build an Internal Assistant Over Confluence and Drive

An internal knowledge assistant is a retrieval system where the hard requirement is not relevance but authorisation: it must answer from what this person is allowed to see, which is a different set from what exists. Get that wrong and the assistant surfaces a salary review to the whole engineering team — quietly, plausibly, and with a citation.

The constraint that shapes everything

In a public docs bot, retrieval quality is the product. Here, authorisation is the product and retrieval quality is a feature. That inversion changes three architectural decisions:

• The index is not a single corpus. Every chunk carries who may see it, and that field is used in the query, not after it.


• The identity of the asker is required. There is no anonymous mode, no shared service account, no “we will add auth later”. A prototype without identity teaches you nothing about the real system.


• Freshness has a security meaning. A stale document is an inconvenience; a stale permission is a breach. They need different refresh paths, which is the one way this differs from is identical in structure and has the same test.
  
  
  

  
  
  
  Revocation, and how stale your index is
  

  
  
  

  Here is the number nobody computes. If permissions sync nightly, then the window between somebody losing access and your assistant enforcing it is up to 24 hours. For a departing employee whose account is disabled centrally, single sign-on closes that hole. For a person moved off a project whose account stays active, it does not.

  
  
  
  
  
  1. Check the user’s principals live, not from the index. Resolve group membership at query time against the directory, with a cache measured in minutes. This closes the common case — someone removed from a group — without re-indexing anything.
  
  
  2. Sync document ACLs on a change feed rather than a nightly crawl, so a document made confidential propagates in minutes.
  
  
  3. Re-check at citation time. Before returning an answer, verify the user can still read every document being cited, using a live call for the small number of documents involved. This is the cheap belt-and-braces check and it catches everything the index missed.
  
  
  4. Record the staleness. Store acl_synced_at and alert when the oldest exceeds your policy. “Permissions are at most 15 minutes old” is a claim you can make to a security reviewer only if you measure it.
  
  
  
  
  

  
  
  
  Leaks that are not in the documents
  

  
  
  

  Three channels leak information without ever showing a restricted passage, and all three are easy to miss.

  
  
  
  
  
  • The shape of the refusal. If “no such document” and “you cannot see that document” are different messages, the difference confirms the document exists. Return one message for both.
  
  
  • Autocomplete and suggestions. Query suggestions built from all users’ queries will suggest “acquisition of…” to someone who should not know there is one. Scope suggestions to the asker, or drop the feature.
  
  
  • Shared caches. A semantic cache keyed on the question alone serves one user’s answer to another. under most regimes that would review this.
  
  
  • Publish what the assistant can see, in plain language, before people use it. The most damaging outcome is not a leak; it is employees discovering afterwards that a system had been reading a space they considered private.
  
  
  
  

  
  
  
  Related
  

  
  
  
  
  
  • 
    
  
  
  Vollständiger Original-Bericht
  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.
  ↗ Original-Artikel auf dev.to lesen