Enterprise search vendors compete on answer quality and, above all, hours saved, a number they collect by asking their own users to guess it. Nobody publishes the number that decides whether the category is safe to buy. How often does an answer leak content its reader was never allowed to see?
An answer engine sits on top of everything the company knows (e.g. the legal hold and the salary bands), and its job is to surface whatever is relevant. Permission fidelity is all that separates "relevant" from "restricted". If a system cannot prove the boundary holds, it is a breach with good UX.
Why RAG makes permissions harder
The standard architecture for AI answers makes the boundary harder to hold, not easier. Documents get chunked, and a chunk cut loose from its document drifts free of the permissions that governed the whole. Chunks get embedded, and vectors carry no permissions unless someone engineers them in. A cache built for one reader is a leak waiting for the second. Synthesis lets a restricted fact surface paraphrased, with nothing verbatim for a filter to catch.
Each step is solvable. But one gap anywhere in the pipeline is a disclosure, so never take "we solved every step, everywhere, all the time" on trust.
Permission fidelity is testable. Ask for the test.
What the test looks like
Unlike most claims about AI, this one can be tested to destruction. Build personas with different entitlements. Seed the corpus with restricted material each persona must never see. Then attack with adversarial queries (e.g. oblique questions and requests to summarise documents the persona cannot open). Score with zero tolerance; disclosure has no partial credit. Rerun on every release, because yesterday's pass says nothing about today's index.
Any vendor could run this and publish it. In a market that reports self-estimated hours saved to one decimal place, none does, as far as we know.
The question that sorts the market
You do not need to referee architectures. Ask one procurement question. Show me your permission-leak test results, on adversarial queries, across personas, for the release I would deploy. A vendor with the artefact produces it gladly. A vendor without it describes their connector-level security model, which is intent, not outcome.
We built Nexus with permissions as the first constraint, not a retrofit. It runs on your premises, every answer is computed inside the asker's own entitlements, and every viewer gets their own total. A vendor who started from relevance cannot bolt that on afterwards. To see it tested against your own entitlements, start here.