Access Control — Enterprise Knowledge Governance

Guardrails and fix patterns to ensure that enterprise knowledge bases are segmented, secured, and retrievable without silent leaks. Use this page when failures look like “permissions bug” but root cause is schema drift, missing contracts, or evaluation blind spots.

When to use this page

Agents or LLMs retrieve snippets that a user role should not see.
Answers omit key passages even though data is present in the KB.
Knowledge base permissions collapse after re-index or migration.
Citation shows content from a restricted section without a trace.
External connectors expose more fields than expected.

Core acceptance targets

ΔS(question, retrieved) ≤ 0.45, with access role enforced.
Coverage ≥ 0.70 for the allowed scope, and <0.05 for disallowed scope.
λ remains convergent across three paraphrases and two seeds.
All snippets carry explicit role_scope, section_id, and source_hash.

Typical access problems → exact fix

Symptom	Likely cause	Open this
Leaked restricted snippet	Missing role tag or weak contract	data-contracts.md, retrieval-traceability.md
Role upgrade not reflected	Cache or index skew	bootstrap-ordering.md, deployment-deadlock.md
Over-blocking (user sees nothing)	Schema mismatch or λ collapse	logic-collapse.md
Citations missing access tag	Parser or contract drift	ocr-parsing-checklist.md, data-contracts.md

Fix in 60 seconds

Measure ΔS for the retrieved vs allowed anchor.
Check role_scope — ensure every snippet has an explicit scope.
Rebuild contract — enforce schema: {snippet_id, section_id, role_scope, hash}.
Re-index if role tags missing, with explicit normalization.
Verify λ stability across paraphrases with access role locked.

Copy-paste schema (YAML)

snippet_id: "KB-12345"
section_id: "SEC-42"
role_scope: "finance_analyst"
source_hash: "sha256:..."
text: "..."

Every snippet must carry these fields, and retrieval probes must validate them before citation.

Escalate when

ΔS remains ≥ 0.60 even with contracts enforced.
Citations show cross-scope bleed.
Index mismatch recurs after two re-indexes.

Escalation path: rebuild with chunking-checklist.md and validate via eval_rag_precision_recall.md.

🧭 Explore More

Module	Description	Link
WFGY Core	WFGY 2.0 engine is live: full symbolic reasoning architecture and math stack	View →
Problem Map 1.0	Initial 16-mode diagnostic and symbolic fix framework	View →
Problem Map 2.0	RAG-focused failure tree, modular fixes, and pipelines	View →
Semantic Clinic Index	Expanded failure catalog: prompt injection, memory bugs, logic drift	View →
Semantic Blueprint	Layer-based symbolic reasoning & semantic modulations	View →
Benchmark vs GPT-5	Stress test GPT-5 with full WFGY reasoning suite	View →
🧙‍♂️ Starter Village 🏡	New here? Lost in symbols? Click here and let the wizard guide you through	Start →

👑 Early Stargazers: See the Hall of Fame —
Engineers, hackers, and open source builders who supported WFGY from day one.

⭐ WFGY Engine 2.0 is already unlocked. ⭐ Star the repo to help others discover it and unlock more on the Unlock Board.

6.2 KiB Raw Blame History