Skip to content
TA Msev

Permission-aware RAG appliance

Clearance keeps retrieval inside the permissions you already enforce.

Sync documents from S3, Confluence, and Google Drive together with their access lists. At query time, only chunks the asking user is allowed to read are ranked and sent to the model.

View on AWS MarketplaceBook a technical demo
retrieval traceExample · illustrative data

Ask as

query
"What is the escalation policy for payments incidents?"
user
alice@example.com
groups
sre-payments, all-staff

candidates 4 → authorized 3 → sent to model 3

  • confluenceSRE/Payments escalation runbookacl: sre-payments
  • gdriveOn-call rotation Q4.xlsxacl: sre-payments
  • s3policies/incident-response.pdfacl: all-staff
  • confluenceLEGAL/Payments disclosure planacl: legal

result Answer cites 3 documents. 1 filtered before generation.

Why it exists

One vector store for everyone is a data leak waiting for security review.

Clearance avoids a second permission model. Source ACLs travel with each chunk, and filtering happens before ranking, not in the prompt.

  1. 01 / sync

    Permissions from the source

    Connectors record who can read each document when it is indexed. Changes at the source update on the next sync.

  2. 02 / query

    Filter before the model

    Retrieval uses the signed-in user's identity. Unauthorized chunks are dropped with a logged reason.

  3. 03 / proof

    Traceable answers

    Every response lists cited documents. Audit logs capture filtered candidates for compliance and debugging.

Pipeline

From source systems to cited answers

  1. 01

    Connect sources

    Point connectors at buckets, Confluence spaces, or shared drives. Initial sync walks documents and their access lists.

  2. 02

    Index with principals

    Each chunk is embedded and tagged with users and groups allowed to read the parent document.

  3. 03

    Sign in through your IdP

    Users authenticate with SAML or OIDC. Group membership from your identity provider drives retrieval filters.

  4. 04

    Answer with citations

    The model receives only authorized chunks. Responses include citations your users can verify in the source systems.

  • Source connectors

    S3, Confluence, and Google Drive with incremental sync. ACL metadata is read from each source on every run.

  • ACL-aware index

    Chunks store allowed principals alongside embeddings. The index lives in your VPC on storage you control.

  • Identity-filtered retrieval

    Ranking runs only on chunks the signed-in user is allowed to read. Unauthorized text never reaches the model.

  • Continuous sync

    Share changes at the source propagate on the next sync. No manual permission matrix inside the AI app.

  • Audit by default

    Every query logs candidates, filtered documents, citations, and the requesting identity for SIEM ingestion.

Configuration

Declare sources and identity once

Deployment templates wire networking and IAM. You add connectors and your IdP settings in a single config file.

Read the full reference in docs. Example values below are illustrative.

clearance.yamlExample
# clearance.yaml · Exampleconnectors:  - type: s3    bucket: docs-prod    prefix: policies/    sync_cron: "0 */4 * * *"  - type: confluence    site: https://example.atlassian.net    space_keys: [SRE, LEGAL, HR]  - type: google_drive    shared_drives: [engineering-handbook]identity:  provider: oidc  issuer: https://idp.example.com  group_claim: groupsretrieval:  filter_before_rank: true  max_chunks_per_query: 12  audit: cloudwatch_logs

FAQ

Common questions about Clearance

See permission-aware retrieval on your sources.

We connect a read-only sync to one bucket or space and walk through the audit log for two identities on the same question.

Book a technical demoView on AWS Marketplace