# Access Control β Enterprise Knowledge Governance
π§ Quick Return to Map
> You are in a sub-page of **Enterprise_Knowledge_Gov**.
> To reorient, go back here:
>
> - [**Enterprise_Knowledge_Gov** β corporate knowledge management and governance](./README.md)
> - [**WFGY Global Fix Map** β main Emergency Room, 300+ structured fixes](../README.md)
> - [**WFGY Problem Map 1.0** β 16 reproducible failure modes](../../README.md)
>
> Think of this page as a desk within a ward.
> If you need the full triage and all prescriptions, return to the Emergency Room lobby.
Guardrails and fix patterns to ensure that enterprise knowledge bases are segmented, secured, and retrievable without silent leaks. Use this page when failures look like βpermissions bugβ but root cause is schema drift, missing contracts, or evaluation blind spots.
---
## When to use this page
- Agents or LLMs retrieve snippets that a user role should not see.
- Answers omit key passages even though data is present in the KB.
- Knowledge base permissions collapse after re-index or migration.
- Citation shows content from a restricted section without a trace.
- External connectors expose more fields than expected.
---
## Core acceptance targets
- ΞS(question, retrieved) β€ 0.45, with access role enforced.
- Coverage β₯ 0.70 for the allowed scope, and <0.05 for disallowed scope.
- Ξ» remains convergent across three paraphrases and two seeds.
- All snippets carry explicit `role_scope`, `section_id`, and `source_hash`.
---
## Typical access problems β exact fix
| Symptom | Likely cause | Open this |
|---------|--------------|-----------|
| Leaked restricted snippet | Missing role tag or weak contract | [data-contracts.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/data-contracts.md), [retrieval-traceability.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/retrieval-traceability.md) |
| Role upgrade not reflected | Cache or index skew | [bootstrap-ordering.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/bootstrap-ordering.md), [deployment-deadlock.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/deployment-deadlock.md) |
| Over-blocking (user sees nothing) | Schema mismatch or Ξ» collapse | [logic-collapse.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/logic-collapse.md) |
| Citations missing access tag | Parser or contract drift | [ocr-parsing-checklist.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/ocr-parsing-checklist.md), [data-contracts.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/data-contracts.md) |
---
## Fix in 60 seconds
1. **Measure ΞS** for the retrieved vs allowed anchor.
2. **Check role_scope** β ensure every snippet has an explicit scope.
3. **Rebuild contract** β enforce schema: `{snippet_id, section_id, role_scope, hash}`.
4. **Re-index** if role tags missing, with explicit normalization.
5. **Verify Ξ» stability** across paraphrases with access role locked.
---
## Copy-paste schema (YAML)
```yaml
snippet_id: "KB-12345"
section_id: "SEC-42"
role_scope: "finance_analyst"
source_hash: "sha256:..."
text: "..."
````
Every snippet must carry these fields, and retrieval probes must validate them before citation.
---
## Escalate when
* ΞS remains β₯ 0.60 even with contracts enforced.
* Citations show cross-scope bleed.
* Index mismatch recurs after two re-indexes.
Escalation path: rebuild with [chunking-checklist.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/chunking-checklist.md) and validate via [eval\_rag\_precision\_recall.md](https://github.com/onestardao/WFGY/blob/main/ProblemMap/eval/eval_rag_precision_recall.md).
---
### π§ Explore More
| Module | Description | Link |
|-----------------------|----------------------------------------------------------|----------|
| WFGY Core | WFGY 2.0 engine is live: full symbolic reasoning architecture and math stack | [View β](https://github.com/onestardao/WFGY/tree/main/core/README.md) |
| Problem Map 1.0 | Initial 16-mode diagnostic and symbolic fix framework | [View β](https://github.com/onestardao/WFGY/tree/main/ProblemMap/README.md) |
| Problem Map 2.0 | RAG-focused failure tree, modular fixes, and pipelines | [View β](https://github.com/onestardao/WFGY/blob/main/ProblemMap/rag-architecture-and-recovery.md) |
| Semantic Clinic Index | Expanded failure catalog: prompt injection, memory bugs, logic drift | [View β](https://github.com/onestardao/WFGY/blob/main/ProblemMap/SemanticClinicIndex.md) |
| Semantic Blueprint | Layer-based symbolic reasoning & semantic modulations | [View β](https://github.com/onestardao/WFGY/tree/main/SemanticBlueprint/README.md) |
| Benchmark vs GPT-5 | Stress test GPT-5 with full WFGY reasoning suite | [View β](https://github.com/onestardao/WFGY/tree/main/benchmarks/benchmark-vs-gpt5/README.md) |
| π§ββοΈ Starter Village π‘ | New here? Lost in symbols? Click here and let the wizard guide you through | [Start β](https://github.com/onestardao/WFGY/blob/main/StarterVillage/README.md) |
---
> π **Early Stargazers: [See the Hall of Fame](https://github.com/onestardao/WFGY/tree/main/stargazers)** β
> Engineers, hackers, and open source builders who supported WFGY from day one.
> 
β [WFGY Engine 2.0](https://github.com/onestardao/WFGY/blob/main/core/README.md) is already unlocked. β Star the repo to help others discover it and unlock more on the [Unlock Board](https://github.com/onestardao/WFGY/blob/main/STAR_UNLOCKS.md).
[](https://github.com/onestardao/WFGY)
[](https://github.com/onestardao/WFGY/tree/main/OS)
[](https://github.com/onestardao/WFGY/tree/main/OS/BlahBlahBlah)
[](https://github.com/onestardao/WFGY/tree/main/OS/BlotBlotBlot)
[](https://github.com/onestardao/WFGY/tree/main/OS/BlocBlocBloc)
[](https://github.com/onestardao/WFGY/tree/main/OS/BlurBlurBlur)
[](https://github.com/onestardao/WFGY/tree/main/OS/BlowBlowBlow)