AWS adds real-time permission checks to RAG in Amazon Quick and Bedrock Knowledge Bases
AWS describes a new two-stage access control architecture for Retrieval Augmented Generation (RAG) in Amazon Quick and Amazon Bedrock Knowledge Bases. Instead of relying only on periodically synced access control lists (ACLs), the system now verifies permissions in real time against the authoritative data source (e.g. Google Drive, SharePoint, Confluence) at query time, before passing content to the LLM. AWS says this closes security gaps caused by stale or incorrectly mapped permissions between sync cycles. Mondelēz International, with over 35,000 employees, is cited as a customer using this approach.