Departments can read different policies.
Do not let another department's document enter an answer.
Choose two appropriate designs.
Attach authorization metadata, filter at retrieval, recheck access before generation and caching, and audit the path.
Detailed explanation
Only documents the user may read become candidates.
Only documents the user may read become candidates.
Indexes and caches are included in the protection boundary.
Indexes and caches are included in the protection boundary.
Similarity does not grant access.
Similarity does not grant access.
Results can cross user boundaries.
Results can cross user boundaries.
Try it yourself
An example you can run in a temporary verification environment.
Amazon Bedrock Knowledge Bases公式のメタデータフィルターとAIF-C01 Domain 3.2を確認する。Expected result
類似度検索と閲覧権限を分離し、認可フィルターを検索経路へ組み込める。Key points
- Metadata filter
- Least privilege
- Cache isolation
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.