Permissions EnforcementProfessional

Each data source uses one of three access models. The model decides which files an agent can retrieve for the person asking, and what that person sees when they browse the data source.

Choose an access model

Permission filtering and User Specific are alternatives. Choose one of them for a data source, not both.

Broad Access (Default)

Data sources created without User Specific and without permission filtering default to broad access. No access controls are applied based on the creator or the original source.

• Admin Visibility: All Platform Admins and Project Admins (with access to the specific project) can view file names and content within the View Chunks menu, even if they don't have access to the original files.
• End-User Querying: Any end-user with access to an Agent connected to this data source can retrieve all data from it, even if they don't have access to the original source.

Permission filtering

With permission filtering on, Airia checks each user's read access in the source system (for example OneDrive, SharePoint, or Confluence) and returns only the content that user can open there.

Supported connectors

The Filter search results based on end user's access permissions toggle is available on these connectors:

• OneDrive and SharePoint
• OneDrive (Service Account)
• SharePoint On-Premises
• Confluence
• Google Drive
• Google Drive (Service account)
• Causeway
• Brightspace, where the toggle reads Filter search results based on end user's enrollment permissions and filters by the user's enrollments

For connectors without this toggle, such as File Upload, Azure Blob Storage, Amazon S3, MinIO, and Website, control access by how you organize the content: create a separate data source for each audience (or use User Specific), and connect it only to agents deployed to that audience.

Before you begin

• SSO: Enable Single Sign-On (SSO) for your Airia instance, so each user signs in to Airia with the same identity your source system knows.
• Matching identities: Each user's Airia sign-in email must be the same identity the source system uses for that person, so Airia can match the user to the file's access list.
• Credential scopes: The credential behind the data source needs the scopes that let Airia read access lists. For a custom Microsoft app, add Directory.Read.All as described in OneDrive and SharePoint. For OneDrive (Service Account), add the User.Read.All and GroupMember.Read.All application permissions. For Confluence, the credential needs read:content-details:confluence, read:user:confluence, read:group:confluence, and search:confluence. For Google Drive, it needs drive.readonly or drive.file. If the selected credential is missing a required scope, the toggle stays disabled until you select a credential that has them.
• An active connection: Keep the data source's credential connected. Airia uses it at query time to evaluate access, so files are shown to end users only while the connection can be established.

Turn on permission filtering

1. Create or edit a data source that uses one of the supported connectors.
2. Turn on Filter search results based on end user's access permissions.
3. Finish the setup and let the first sync complete.
4. Connect the data source to your agent.

💡 Note: Only the user who created the data source can turn permission filtering on or off.

Interfaces that carry the user's identity

The check runs against the identity of the person the agent is running for. Choose an interface that passes a signed-in user to the agent:

For agents that serve many users from a permission-filtered data source, deploy them to the Airia Catalog or use Airia User mode on Teams and Slack. For audiences reached through the Chat Widget or an API key, connect the agent to a data source that uses Broad Access and holds only the content that audience may see.

What users see for files they can't access

• Users without access to specific files see those file names redacted in the platform.
• They still see the total file count, connector type, and data source name.
• They cannot view ingestion artifacts such as generated chunks or SQL tables for those files.
• The agent does not retrieve content from those files for them, even when the data source is connected to the agent.
• Platform Admins can still schedule synchronization tasks for these data sources.

How quickly permission changes take effect

For the OneDrive and SharePoint connectors that users connect with their own sign-in, Airia synchronizes source permissions on a schedule rather than reading them live on every query. As a result, permission changes you make in OneDrive or SharePoint are not reflected instantly:

• Sharing changes on a file or folder (granting or removing a user's or group's access to the item): reflected within about 2 hours. During this window, a user whose access was removed may still be able to retrieve the file, and a user who was just granted access may not yet be able to retrieve it.
• Group membership changes in Microsoft Entra ID (adding or removing a user from a security group that grants access): reflected at the next scheduled identity synchronization, which runs daily (up to ~24 hours).

⚠️ Warning: Plan for synchronization lag. If you need a user's access removed immediately, remove their direct access to the specific file or folder (reflected within about 2 hours) rather than relying only on a group membership change. Changes are often reflected sooner.

💡 Note: This synchronization schedule applies to the OneDrive and SharePoint connectors only. All other connectors with permission filtering, including OneDrive (Service Account), Confluence, Google Drive, Causeway, and Brightspace, check access with the source system when content is requested. Each result is cached for a short time, so with the default cache a change in the source system can take up to about an hour to apply.

Verify results for a non-admin user

Test with accounts other than the data source creator, because the creator's own access usually covers everything in the data source.

1. Pick a file in the data source. Choose one test user who can open it in the source system and one who can't. Both need access to the agent.
2. Sign in to Airia as each test user (through SSO) and ask the agent a question that only that file answers.
3. The user with access gets an answer drawn from the file. The user without access gets no content from it.
4. As the user without access, open the data source and confirm the file name appears redacted.

If the user with access gets no content, confirm that their Airia email matches their identity in the source system, that the agent runs in an interface from the table above, and that any recent sharing change has had time to synchronize.

User-Specific Access

When a data source is configured as User Specific, access is restricted to its creator.

• Exclusive Access: Data is exclusively available to the user who created the data source. Other Admins cannot edit, authenticate, or add files to this data source.
  • For File Upload data sources, other users can add files but will only see the files they added.
• Visibility: The creator can view the file list, open files to see their content, generated chunks, SQL tables (for CSV/Excel), and other ingestion artifacts. Other Admins will not see the file count or file list.
• Querying: If this data source is linked to an Agent, only the creator can query it through that Agent.