After access is revoked, can your AI search still return the document?

Removing someone from a document’s access list should change what an AI search application returns. The awkward case is a request already in progress. Retrieval was allowed, an answer was prepared, and permission changed before the response was ready. A cached answer or a direct citation can create another route to the same content.

Access revocation needs an authorization check on every response path. An initial retrieval filter cannot establish that a later response is still allowed.

In an Azure sample’s January 2026 migration report, a user described citations continuing to use the original content container after setting up an ACL-enabled ADLS container. That report motivates checking the whole path. It does not establish a current vulnerability or prove how a different application behaves.

The accompanying example isolates that application decision using two fictional tenants, stored documents and a small SQLite database. It uses fixed text rather than an LLM. The test concerns who can receive a response, not whether a model can be persuaded to disclose information.

Follow the content beyond retrieval

The first implementation deliberately checks document permission only while preparing an answer. It stores the resulting text and the documents used. After permission is revoked, three operations still return the protected text: completing the prepared answer, reading its cache entry and opening its citation.

The corrected implementation checks the current session and source permissions at each response path. Identity comes from fixture session records; the example does not implement real sign-in or token verification. The caller supplies an opaque pending-response ID, not an answer body or a list of sources it claims to have used. The service keeps that text and dependency list itself, bound to the originating session, tenant and user.

For the cache, a key containing tenant and user prevents one person’s result from becoming another person’s cache hit. That partitioning is only part of the check. The same person’s permission may have changed, so the service checks the stored sources again before returning the cached text.

On a narrow screen, scroll the table sideways to read every column.

The last row matters. A test that rejects every request has not shown that useful access still works. The companion also checks unknown and disabled sessions, another user attempting to complete pending work, and changes to a document’s revision.

An answer needs a complete source record

A response can depend on more than its visible citations. A generator may use several documents while showing only one link. If a revoked source contributed to the text, removing its citation does not remove the information learned from it.

This fixture knows the full dependency list because its fixed answer builder joins the stored chunks. It rejects a prepared answer if any contributing document is no longer readable or has a different revision. A mixed-source test verifies that one revoked dependency blocks the whole response.

A production integration needs its own way to retain the context used by the generator. It must also decide whether to regenerate an answer from currently permitted material or tell the user that the request can no longer be completed. The demonstration chooses denial; it does not implement regeneration or an index rebuild.

State the access revocation boundary precisely

The corrected path reads current identity, permission and source state in one SQLite transaction before creating the returned Python object. In the tested sequence, revocation commits before that transaction. The response is denied even though preparation had succeeded earlier.

That is a useful, bounded result. It says nothing about a distributed cache’s propagation delay or a permission change that occurs after authorization while bytes are being streamed. Information already delivered cannot be recalled. Content legitimately retrieved earlier may also have reached a model provider before a later revocation; provider retention is a separate question.

Connector behavior needs equally careful treatment. Microsoft’s current SharePoint permission-ingestion documentation distinguishes incremental updates to unique item permissions from inherited parent permissions that require explicit refresh. That is a preview-specific SharePoint contract, not a fix for the separate ADLS sample report. The local companion tests neither connector.

Try the acceptance cases on one source

Run the demonstration and tests from the companion directory. The execution record identifies the tested files and environment:

python3 access_demo.py
python3 -m unittest -v

The execution record identifies Python 3.14.7, SQLite 3.53.4 and the tested macOS environment on 20 September 2026. No credentials, external model or customer records are required.

For an existing assistant, begin with one source connector and trace its answers, citations and caches. Identify where current authority comes from, when each path checks it and which delay the system can actually support. Keep permission revocation separate from deletion of stored content: this example denies access but retains pending and cached text in its database.

Allerin’s GenAI engineering and AI security work can start with that bounded review. The useful deliverable is an acceptance matrix tied to the application’s identity and source systems, with the remaining integration work made explicit.