Document permissions

Before Genie uses a document for someone, it checks two things: can the person open the knowledge base, and may they see this document in it. This page explains who sees which knowledge base, how to restrict documents, folders and tags to some people, how permissions mirrored from SharePoint, Teams and other sources combine with yours, how to give access that ends on a date, and where a knowledge base's sensitivity level fits in. Restricting documents is done by the knowledge base admins: the knowledge base's creator and the workspace's Admins and Owners. The same rules apply everywhere Genie shows content: document lists, search, answers, agents, Wiki pages, previews and downloads.

Who sees what

Knowledge bases

Who	Which knowledge bases	What they can do
Members of the workspace	Every knowledge base in the workspace	Everyone reads and asks. Contributors manage the knowledge bases they created; Admins and Owners manage all of them.
Workspaces in a Shared space the knowledge base is shared with	That knowledge base, under Knowledge → Shared with me	Read-only: search and ask. Editable: also change documents, unless the person is a Viewer in their own workspace (they stay read-only). Settings, sharing and deletion stay with the workspace that owns it.
Workspaces below a parent workspace that shares down	The knowledge bases the parent's admins shared to Child workspaces	Search and ask, always read-only
People who use an agent shared with their workspace	The agent's knowledge bases, only through that agent	Read-only

• Inside a workspace there is no member list per knowledge base: every member can open every knowledge base. To keep content from some members, restrict its documents, folders or tags (below), or keep it in a separate workspace (see Nested departments).
• Sharing never raises anyone's role. Nothing flows sideways or upwards: a child workspace does not see its sibling's knowledge bases, and the parent does not read its children's knowledge bases through sharing down.
• To share a knowledge base, see Knowledge bases. Sharing down to child workspaces is switched on for the parent by a system administrator (see System administration).

Documents

Inside a knowledge base, everyone who can open it sees every document, unless:

• a knowledge base admin restricted the document, its folder or one of its tags in Genie (see Restrict a document, folder or tag), or
• the document comes from a data source that mirrors the permissions of the source system (see Source permissions).

A person who may not see a document gets nothing from it: it is absent from lists, folder counts and search, its text never reaches answers or agent tools, Wiki pages built from it are hidden, and it cannot be previewed or downloaded. In a conversation someone shares, citations of documents the viewer may not see show as restricted, without the document's name.

Some ways of reaching Genie have no person behind them, so they only ever get unrestricted documents: API keys, the website widget and the MCP server. People who chat through Microsoft Teams or Zalo see what their linked Genie account sees, and only unrestricted documents until they link their account (see Teams, Zalo and the website widget).

Restrict a document, folder or tag

Knowledge base admins can restrict content. A lock badge marks restricted documents, folders and tags. Readers who may see restricted content see the badge too, but never who else may see it; the others do not see the content at all.

To restrict	Do this	It covers
A document	Click the document to open it, then go to Access	That document
A folder	In the Folders tree, click ⋯ next to the folder, then Access	Every document in the folder and its sub-folders, including documents added or moved there later
A tag	Open Filters above the document list and click the lock icon next to the tag	Every document with the tag, including documents tagged later

Then:

1. Choose Only the people listed below.

2. Choose the kind of entry, fill in the value and click Add. Repeat for each entry:

   Entry	Lets in	Example
   Member	One member of the workspace	Thu Hoang
   Group	Members whose groups attribute lists the group	Contoso-HR
   Role	Members with that role or a higher one, shown as for example Contributor and above	Admin and above
   Attribute	Members with an attribute holding the value; keys and values are compared without case	department = HR, branch = Da Nang

   To make an entry temporary, pick a date in Access ends on (optional) before you click Add (see Temporary access).

3. Click Save.

Screenshot coming soonThe salary bands document of Human resources, restricted to the HR department and adminswebsite-docs/public/screenshots/en/document-permissions.png

The salary bands document of Human resources, restricted to the HR department and admins

Example at Contoso: in the Human resources knowledge base, the Payroll folder is restricted to the attribute department = HR. Thu Hoang, the HR manager, sees the folder and gets answers from it. Nam Vo in sales does not see the folder at all, and Genie never quotes it to him.

To lift a restriction, open the same Access panel, choose Everyone who can read the knowledge base and click Save.

Where the values come from:

• Attributes are set per member on Settings → Members, or arrive at sign-in from Microsoft Entra ID when your system administrator maps them (see Member attributes).
• A Group entry matches the member's groups attribute: set it on Members, or ask your system administrator to map the identity provider's groups to it at sign-in (see SSO profile attributes). Microsoft Entra ID sends groups as object IDs, so a Group entry must use the same value the attribute holds. When in doubt, an Attribute entry such as department = HR is easier to check.

How rules combine

• Within one restriction, any entry is enough. A folder open to Contoso-HR and to Minh Le lets in everyone in the group and Minh Le.
• Across restrictions, all must pass. A document can be covered by its own restriction, by the restriction of every folder above it and by the restriction of each of its tags. A reader must pass every one. A document in a restricted folder that also carries a restricted tag is seen only by people who pass both.
• Mirrored and Genie rules both apply. When a document keeps its permissions from the source system, a reader must pass the mirrored rule and any rule you set in Genie (see Source permissions).
• Knowledge base admins always see everything, so they can manage the content. This includes the admins of a parent workspace that passes its admins down.
• A restriction with no entries leaves the content to the knowledge base admins only.
• Moving and renaming follow the folder: renaming a folder keeps its restriction, and a document moved into a restricted folder becomes restricted.
• People from other workspaces (through a Shared space or sharing down) hold no role in your workspace and none of your member attributes. Member entries naming them, and Group and Attribute entries matched through the attributes they receive at sign-in, let them in. Role entries never do.

Source permissions

When a knowledge base syncs from a data source, every synced document is visible to everyone who can read the knowledge base, unless the data source mirrors source permissions. With Mirror source permissions turned on in the data source's Strategy step, each document keeps who may read it in the source system: a SharePoint file only HR can open stays visible to HR only.

Mirroring is offered for SharePoint / OneDrive, Microsoft Teams, Windows file servers, Power BI and Confluence. It is off by default. Setting it up is described in Data sources.

How people in the source are matched to Genie:

In the source	In Genie
A Microsoft Entra ID user	The workspace member with the same Entra ID account or email
An Entra ID group	Its members, read again at every sync, including nested groups
A Teams channel	The team's members for a standard channel; the channel's own members for a private or shared channel
"Everyone", "Everyone except external users", a "People in your organization" link	No restriction: everyone who can read the knowledge base
An "Anyone with the link" link	No restriction, and the sync log warns about it
SharePoint groups such as "HR Visitors"	Mapped under SharePoint groups in the data source; "Owners" and "Members" of a site connected to a Microsoft 365 group are mapped automatically
Anyone else (no Genie account, a guest, a group whose members cannot be read)	Denied, and listed in the sync log

How mirrored permissions combine with yours:

• The mirrored rule sits next to any rule you set on the same document, folder or tag, and a reader must pass both. Use a Genie rule to narrow what the source allows, for example to keep an HR file to the HR managers although the whole HR group can open it in SharePoint. A Genie rule cannot widen what the source allows.
• The document's Access panel shows the mirrored rule, read-only, above yours (Additional restriction set in Genie (both apply)). To change it, change the permissions in the source, or turn off Mirror source permissions.
• Changes in the source (someone leaves a group, a file's sharing changes) reach Genie at the next sync.
• Turning Mirror source permissions off removes all mirrored rules when you save: the synced documents become visible to everyone who can read the knowledge base.
• Exchange mailboxes cannot mirror permissions. Keep each shared mailbox in its own knowledge base, or restrict the mailbox's folder with a Genie rule.

Temporary access

Access can end on a date, for example for an external auditor who joins for two weeks. You can set an end date on:

Access	Where	Who can set it
A member of the workspace	Settings → Members: Access ends on when inviting, or the Access column of the member list (see Members and sign-in)	Owners
A knowledge base shared with a Shared space	The knowledge base's Settings → Sharing: Share ends on when sharing, or the Access column of the share list	Knowledge base admins
A member allowed to use an agent	The agent's Who can use it → Only the members I choose → End dates (optional) (see Agents and the default assistant)	Whoever can edit the agent
An entry of a document restriction	Access ends on (optional), next to each entry in the Access panel	Knowledge base admins

What happens:

• Access lasts until the end of the chosen day. Owners cannot have an end date.
• When the date passes, the access stops working at once: an ended membership no longer opens the workspace, an ended share no longer gives the Shared space the knowledge base, an ended agent grant no longer lets the member use the agent, and an ended document entry no longer shows the person the document.
• Once a day, Genie removes what ended, records it in the audit log and, when outgoing email is set up, emails the person who granted it.
• A document restriction whose last entry ended stays in place: the content is left to the knowledge base admins until someone changes it.
• The member list shows the time left (for example Ends in 5 days), and its Ending soon filter lists members whose access ends in the next 30 days.

Sensitivity

Every knowledge base has a sensitivity level: Public, Internal (the default), Confidential or Restricted. The level does not change who can read the knowledge base. It decides which models may receive its content, following the platform's model data policy; what each level allows is explained in Models and data protection.

To set the level:

1. Open the knowledge base's Settings → Data protection.
2. Under Sensitivity, choose the level. The page lists any of the knowledge base's models that the level would no longer allow.
3. Click Save and Close.

Who can change it:

• When creating a knowledge base, its creator picks any level.
• Afterwards, the creator can raise the level; only a workspace Admin or Owner can lower it.
• The level is changed only in the workspace that owns the knowledge base, never by people it is shared with.

Levels other than Internal show as a badge in the knowledge base list, and the knowledge base's page always shows its level. Every change is recorded in the knowledge base's Activity log.

Good to know

• Every change to a restriction is recorded in the knowledge base's Activity log, with the entries granted, changed and removed.
• The answer text of a conversation that was shared is not rewritten. If the person who asked could read a restricted document, the answer may quote it, even when the people it is shared with cannot open the source. Share such conversations with care.
• The Items count shown for a knowledge base in the knowledge base list counts all its documents, including those a reader may not see.
• Duplicate does not copy a knowledge base's restrictions.
• FAQ knowledge bases cannot be restricted per entry.
• Agents follow the person who asks: an agent only uses the documents that person may see, whoever created the agent.
• Metadata filters only narrow a search; they never give access to a document (see Metadata fields and filters).

Related pages

• Knowledge bases
• Data sources
• Members and sign-in
• Models and data protection
• Administration overview
• Ask your documents (user guide)