Permission-aware retrieval, explained without the jargon

Every company that pours its documents into an AI tool eventually asks the same nervous question: wait — who can the AI answer from? If the intern asks about salaries and the HR spreadsheet is in the index, does the intern get an answer sourced from it?

In a lot of tools, the honest answer is "yes, unless a filter catches it afterwards." We think that's the wrong place to put the fence.

The wrong place: filtering after the fact

The naive design retrieves the best-matching passages from everything, lets the model write an answer, and then tries to strip out anything the user shouldn't see. By then it's too late. The restricted content already shaped the answer — its numbers, its phrasing, its conclusions. Redacting the citation doesn't un-tell the secret.

The right place: inside the search

AskMyDocs applies your permissions during retrieval itself. When your question goes looking for candidate passages, the search only runs over documents you're allowed to see — your own, your teams', and anything granted to your role. A document outside that set isn't ranked lower. It isn't a candidate at all. It never reaches the model, so it can't influence the answer, and it can't leak through a paraphrase.

A useful side effect: "no accessible match" and "no match" look identical. You can't probe for the existence of a document you're not allowed to see by watching how the answer changes.

What decides who sees what

• Workspace isolation — every row of data is bound to your workspace with PostgreSQL row-level security, and the policies fail closed.
• Four roles — viewer, member, team manager, admin — with clear boundaries; nobody can grant a role above their own.
• Teams — documents scoped to the team that owns them.
• Per-document grants — share one document with a specific person, a team, or a minimum role.

Permissions are checked against the database, not against whatever a client claims. And every download, denied download and permission change lands in an append-only audit log you can export as CSV.

Same question, different answers — on purpose

The landing page shows a small table of documents and personas — intern, manager, admin — with different checkmarks. That's not marketing shorthand; it's literally how retrieval behaves. The intern's answer about company policy cites the HR handbook. The admin's answer to the same question may also cite board minutes. Both answers are true, both are cited, and both are built only from what that person is allowed to read.