Permission-aware ingestion
Each document and chunk keeps its source permissions. Files with no matching rule are not indexed.
GenAI & Agents
Secure RAG Starter
Connect generative AI to your documents and keep existing access rules.
A reference implementation of retrieval-augmented generation (RAG) for enterprise content. Document permissions carry through to the search index, so people only get answers from content they can already see. Every answer cites its sources and every request is logged. We adapt it to your document stores, identity provider, and chosen models.
Download the PDFWhat you get
An assistant that answers from your content and respects who can see what.
Free download · PDF · 10 pages
Get the Secure RAG Starter overview
The problem it solves, what is included, how it works, the technical components, and how we adapt it with you.
Your download has started.
We also emailed the link to . It stays valid for 7 days.
Download didn't start? Get the PDF
Want to see how it would fit your data? Talk to us.
The problem
An assistant can reveal what a search box never would.
Connect a model to your document stores and it can answer from the salary file or the board pack for anyone who asks. Hidden instructions inside documents can also steer what it says.
What this accelerator does
The Secure RAG Starter carries document permissions through to the search index, so people only get answers from content they can already see.
What's included
Answers from your content, inside your access rules.
Four parts, each adapted to your data, platforms, and controls. What we adapt for you is yours to keep.
Answers with citations
Every answer cites the source documents it came from.
Logging, limits, and cost controls
Every request logged, with daily request and cost limits.
Connectors
SharePoint Online and OneDrive through Microsoft Graph, and Confluence Cloud, with their permissions.
How it works
How permissions work.
Principals at ingestion
Every document gets allowed and denied groups or users, read from the source system.
Default is nobody
A file that matches no rule is not indexed at all.
Chunks inherit
Splitting a document never widens who can see it.
Filter before ranking
Content a user cannot read is never scored or returned.
Check again
The assistant re-checks every result and raises an alert if any fails.
Deny wins
A denied group overrides an allowed one, whichever groups a person belongs to.
Technical detail
Under the hood.
Vendor-neutral Python and configuration, Azure first, with tests included from the start.
- Ingestion and ACLs
- Permission rules per document and chunk, plus injection screening
- Search
- Azure AI Search, with the permission filter inside the query
- Generation
- Azure OpenAI, with retrieved sources marked as untrusted data
- Connectors
- Graph with Sites.Selected; Confluence through a read-only service account
- Assistant layer
- Re-check, citations, request log, and usage and cost limits
- Offline mode
- Keyword search and extractive answers for tests and demos
Proof in the package
Worked example: the same question from two employees.
Bob works in engineering. Alice works in HR. Both ask for the salary range for band L4.
What happens
- Bob: “I could not find this in the documents you have access to.”
- Alice: the answer, with a citation
- A supplier FAQ holds a hidden instruction to the AI
- Ingestion reports it and leaves that paragraph out
Result
The rest of the supplier FAQ stays searchable. Every request is logged, and any failed permission re-check raises an alert.
How we run it with you
Adapted in the first cycles, handed over at the end.
- 01
Connect sources
SharePoint, OneDrive, Confluence, or a loader for your other stores, with real permissions.
- 02
Map identity
Your identity groups mapped to principals from the signed-in user's token.
- 03
Choose models and prices
Your model deployment, with prices set so cost limits mean something.
- 04
Test before launch
A test set from your content, with one permission test per restricted area.
You keep the ingestion, connectors, index schema, and assistant code, running under your own identities.
Where it fits
Platforms, related accelerators, and limits.
We state the limits up front, and we recommend tools based on fit. We do not resell platforms.
Works with
- Azure AI Search and Azure OpenAI
- SharePoint Online, OneDrive, and Confluence Cloud
- Microsoft Entra ID groups
Pairs with
- GenAI Evaluation Tests check it before every release
- AI Agent Controls govern any agents built on it
- Registered in the AI Governance inventory
Assumptions and limits
- Permissions are as current as the last sync, so we plan a sync schedule
- Injection screening catches common patterns; it is one of three layers
- Production runs on Azure AI Search with vector search added
Take the overview with you.
Get the 10-page PDF to share with your team, or tell us the decision you want to improve and we will tell you whether the Secure RAG Starter fits.