AWS 为 RAG 引入实时 ACL 校验，强化企业权限控制
原标题：Rethinking access control for RAG with Amazon Quick and Amazon Bedrock
AI 摘要
AWS 在 Amazon Quick 和 Amazon Bedrock Knowledge Bases 中引入实时 ACL 校验，在原有预检索过滤基础上，于查询时直接向权威数据源（如 Google Drive）验证用户权限。该方案针对传统复制-过滤式 RAG 权限控制存在的三大缺陷：AI 系统并非权限权威源、同步间隙导致权限过期、数据源权限模型持续演进。通过两阶段架构兼顾语义检索性能与实时安全性，确保被撤销权限的用户无法再获取 AI 生成的敏感内容。
正文节选
Rethinking access control for RAG with Amazon Quick and Amazon Bedrock Enterprise organizations are adopting Retrieval Augmented Generation (RAG) to unlock insights from company knowledge sources like Microsoft SharePoint, Google Drive, and Atlassian Confluence. However, these knowledge sources contain sensitive information governed by complex permission structures. Making sure that AI-generated answers respect those permissions is one of the hardest challenges in enterprise AI. In this post, we