[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"article-body-permission-aware-is-the-hard-part":3},"\nEnterprise search vendors compete on answer quality and, above all,\nhours saved, a number they collect by asking their own users to\nguess it. Nobody publishes the number that decides whether the\ncategory is safe to buy. How often does an answer leak content its\nreader was never allowed to see?\n\nAn answer engine sits on top of everything the company knows (e.g.\nthe legal hold and the salary bands), and its job is to surface\nwhatever is relevant. Permission fidelity is all that separates\n\"relevant\" from \"restricted\". If a system cannot prove the\nboundary holds, it is a breach with good UX.\n\n## Why RAG makes permissions harder\n\nThe standard architecture for AI answers makes the boundary harder\nto hold, not easier. Documents get chunked, and a chunk cut loose\nfrom its document drifts free of the permissions that governed the\nwhole. Chunks get embedded, and vectors carry no permissions unless\nsomeone engineers them in. A cache built for one reader is a leak\nwaiting for the second. Synthesis lets a restricted fact surface\nparaphrased, with nothing verbatim for a filter to catch.\n\nEach step is solvable. But one gap anywhere in the pipeline is a\ndisclosure, so never take \"we solved every step, everywhere, all\nthe time\" on trust.\n\n*Permission fidelity is testable. Ask for the test.*\n\n## What the test looks like\n\nUnlike most claims about AI, this one can be tested to destruction.\nBuild personas with different entitlements. Seed the corpus with\nrestricted material each persona must never see. Then attack with\nadversarial queries (e.g. oblique questions and requests to\nsummarise documents the persona cannot open). Score with zero\ntolerance; disclosure has no partial credit. Rerun on every\nrelease, because yesterday's pass says nothing about today's index.\n\nAny vendor could run this and publish it. In a market that reports\nself-estimated hours saved to one decimal place, none does, as far\nas we know.\n\n## The question that sorts the market\n\nYou do not need to referee architectures. Ask one procurement\nquestion. Show me your permission-leak test results, on adversarial\nqueries, across personas, for the release I would deploy. A vendor\nwith the artefact produces it gladly. A vendor without it describes\ntheir connector-level security model, which is intent, not outcome.\n\nWe built Nexus with permissions as the first constraint, not a\nretrofit. It runs on your premises, every answer is computed inside\nthe asker's own entitlements, and\n[every viewer gets their own total](/insights/one-number-per-viewer).\nA vendor who started from relevance cannot bolt that on afterwards.\nTo see it tested against your own entitlements,\n[start here](/contact).\n",1786984937065]