Permissions belong in the assembly context

The new fight in enterprise AI is not about whether to check permissions. It’s about when. The cleanest answer is: before the model ever sees the text. If access is handled after retrieval, after hydration, or after summarization, you’ve already lost the part that matters most. Once restricted material is in the system, a later check is just paperwork.

That is why the “context assembly” idea is getting traction across the big platforms. AWS announced AWS Context in June with a design that ties the graph to Glue Data Catalog, SageMaker Unified Studio, and Lake Formation, and checks identity again when someone asks. Microsoft shipped identity-aware retrieval on June 16. AWS announced its version on June 17. One is available now; the other is still listed as coming soon, with no GA date, no regional list, and no pricing. The architecture is converging faster than the shipping.

The catch is that enterprise data does not live in one neat lake. AWS says its own boundaries stop at the lake, and its August guidance on AgentCore makes that explicit: the agent hands Salesforce a token scoped to the actual user, then Salesforce enforces its own sharing rules. That is a sensible boundary. It is also a reminder that permissions in one system do not magically govern Slack, Jira, Google Drive, Confluence, or GitHub. Every system still has to answer for itself.

This is where late filtering falls apart. A retrieval system can fetch opaque IDs, authorize them, and only then hydrate the documents the user may read. That works. But if the documents are fetched first and checked later, the model has already seen them. AWS itself warns that broad-credential approaches create a single point of failure, and it describes metadata filtering as application-layer enforcement, not an IAM condition key. In plain English: the tags are not the guardrail.

The security people are not crying wolf here. Penn State researchers found that summarization can reduce leakage in untargeted attacks but increase it in targeted ones. A 2026 preprint found cross-tenant leakage in vector-to-graph pipelines and fixed it by re-checking authorization at every hop. Even OWASP has moved sensitive information disclosure up to second place in its 2025 list and added a vector-and-embedding weakness category. The lesson keeps repeating because the bug keeps repeating: if identity shows up too late, the model gets to read the thing before the system decides it shouldn’t have.

And the enterprise evidence is already ugly. A 2024 Gartner survey of 132 IT leaders found that oversharing delayed Microsoft 365 Copilot rollouts for 40 percent of them by 3 months or more. Copilot itself is not the culprit; Microsoft says it checks permissions at query time and trims results to what the signed-in user can access. That is the point. The exposure was there all along, waiting for retrieval to find it. In AI, a good search box is also a very efficient security test.