Search internal documents by meaning.
Return only documents whose department and publication scope match the user.
Which design is appropriate?
Combine semantic similarity with metadata and authorization filters so a highly similar but unauthorized document is not returned.
Detailed explanation
Semantic similarity alone is not an authorization check.
Semantic similarity alone is not an authorization check.
RAG must not bypass source-data permissions.
RAG must not bypass source-data permissions.
This loses the access boundary.
This loses the access boundary.
Search does not require exposing protected documents.
Search does not require exposing protected documents.
Try it yourself
An example you can run in a temporary verification environment.
Amazon Bedrock Knowledge Bases公式のメタデータフィルターとデータアクセス設計を確認する。Expected result
類似度検索と認可フィルターを別の条件として説明できる。Key points
- Metadata
- Access scope
- Similarity and authorization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.