What is permission-aware retrieval?
Permission-aware retrieval means an AI agent can only answer from information the person asking is allowed to see. Each person's access is checked, tool by tool, before anything reaches the model, so two people asking the same question get different answers, each limited to their own access at work.
Last updated 25 October 2026 · Mert Uzun, co-founder
Why it matters
46%
of CISOs are confident they can centrally control what AI agents access. (Okta, Global CISO Insights 2026)
21%
of CISOs govern AI agent access with shared credentials. (Okta, Global CISO Insights 2026)
97%
of organizations that had an AI-related breach lacked proper AI access controls. (IBM, Cost of a Data Breach 2025)
How it works in practice
Most AI agents connect to company tools with one key that opens everything. Whoever asks gets whatever the key can reach. An intern and the CFO get the same answer.
Permission-aware means the answer follows the person, not the key. If you cannot open a file at work, your agent cannot use it either.
Where a tool has its own access rules, those rules apply. Where it has none, the company's hierarchy decides. Walls set by legal or compliance sit on top.
When someone changes role or leaves a channel, their answers change with them.
How Mithrandir does it
Mirrors each tool's own permissions, and follows your company hierarchy where a tool has none.
Ethical walls on top. Restricted content never reaches a model.
0 leaks measured across 30,000+ entries.
Questions
- Why not give the agent one service account?
- A service account sees everything it was granted, so everyone who asks sees the same. Every agent becomes a way around your access rules.
- What happens when permissions change in a tool?
- Access follows. When someone is removed from a channel, a drive or a repository, what they can get through their agent shrinks with it.
- What about tools with no permissions of their own?
- The company hierarchy decides. A manager sees their team's work. A team member sees their own work and what is shared with them.
- Does restricted content ever reach the model?
- No. Content a person cannot access is left out before the question goes to the model, so it cannot appear in the answer.
