How do you make sure RAG over SharePoint doesn't reveal other people's documents?
Answer out loud or in your head first, then compare.
Answer
I check the right to a document before passing its content to the model. With my own index, I have to store and update the information about who can read each document. An alternative may be searching through a solution that enforces access at the source. The choice depends on what the integration can actually do.
SharePoint has groups and permissions inherited from folders or sites, so I don't assume one simple read always describes everything. Restricting the app to selected sites doesn't replace individual users' permissions. Access changes have to account for the index, cache and citations. Ready-made connector features also need checking for limitations and preview status.
Why it matters: A characteristic problem of company data in this role.
Possible follow-ups: What if the user lost access a moment ago and the index still has the old permissions?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- G-P01 · What is RAG? — RAG and retrieval
- M-P02 · What are Entra ID, Microsoft Graph and SharePoint? — Python, Microsoft and SAP
- D08 · How does authentication differ from authorisation? — Backend, data and system design
Practise in code
- An assistant with a new requirement — guided self-review
Further reading
- Azure AI Search: Document-level access control(opens in a new tab)Docs; accessed 22.10.2026. Security filters, native ACLs and preview features; syncing permissions needs an explicit mechanism.
- Microsoft ISE: Propagating SharePoint Document Permissions(opens in a new tab)30.04.2026. An example of materialising ACLs and Sites.Selected; check the scope for your environment.