AWS has added real-time permission verification to Amazon Quick and Amazon Bedrock Knowledge Bases, addressing a common weakness in retrieval-augmented generation systems: access lists copied into a search index can become stale before the next synchronization.
The new design uses two stages. First, the service searches its vector index and applies cached access-control data to narrow the candidate documents. It then checks those candidates against the authoritative source, such as Google Drive, before passing any text to the language model. Documents the current user cannot open are removed from the context.
A cached-only system can leak information after an employee loses access or a group membership changes without producing an event the connector understands. Checking every document live would be too expensive, so AWS combines fast pre-filtering with verification only for the smaller retrieved set.
The feature preserves source permissions more accurately, but it does not solve every RAG security problem. Administrators still control service credentials and connector scope, while grounding and content guardrails address different risks. Teams should test failure behavior when the source API is unavailable and confirm that no answer is generated from unverified material.