Trusted application code sets the search scope from the identity provider, so the model never picks the user.

Amazon Web Services published a design for fine-grained access control in Amazon Bedrock Managed Knowledge Base tools. The knowledge base reads a user context field that carries the user email in userId and returns only documents that user can view. Trusted code fills that field, so a prompt injection cannot make the agent search as another employee.

The service ties to Amazon Bedrock AgentCore Gateway, which exposes the knowledge base to agents as Model Context Protocol tools. AWS frames the capability around multi-tenant SaaS assistants, where many customers share one agent and one corpus of documents. Traditional applications scope searches in code, while agents let a model choose tools and arguments at runtime.

Builders running shared assistants get a permission model that does not depend on model behavior. AWS recommends independent defense layers in case the user context path has a bug or an attacker bypasses it. A mis-scoped search can drop another department’s plan or another tenant’s records into an answer, so teams need to test these boundaries before shipping.

AWS points teams to the ACL awareness setting as the starting point and to a companion walkthrough for multi-tenant agentic chat applications. Operators should verify that the user context value comes from a verified identity claim and not from a model-supplied argument. Auditing which tool arguments reach the search backend gives a direct check on whether the control holds in production.

What matters

• Amazon Bedrock Managed Knowledge Base now filters search results by the requesting user’s identity.
• Builders can share one agent and one knowledge base across tenants without leaking documents.
• Teams should add independent defense layers in case the user context mechanism is bypassed.

Why it matters

Teams should add independent defense layers in case the user context mechanism is bypassed.

This GenAI News article was prepared in original wording using reporting and materials published by AWS Machine Learning Blog. Source reference: https://aws.amazon.com/blogs/machine-learning/fine-grained-access-control-for-amazon-bedrock-managed-knowledge-base-tools/.

Drafted by the GenAI News review pipeline.