How to set access levels on a knowledge base
A knowledge base names who may search, open, or export each set of documents, and keeps an audit record of those actions, before a reply leaves the library. Assistant permissions say which material each role may read and which actions it may propose. Citations say which path, version, and section a reply carries. This note says who may search, open, and export inside the library itself.
On this page
- Keep access levels apart from assistant permissions and citations
- Logical access follows an authorisation that has already been approved
- Search, open, and export are three columns
- Role, department, and sensitivity sit on one row
- Name the events to log, and write why those events are enough
- An audit record answers six questions
- A reply does not leave until the account can open the passage
- A set is classified when the columns, the rationale, and the record are written
Keep access levels apart from assistant permissions and citations
The assistant permission table starts with a role, then adds accounts, and says which material that role may read and which actions it may propose. A citation requires the path, the version, and the section before a reply is sent, and someone who can open that section has seen the sentence. Access levels answer a different question: for a set of documents, who may find it in the library, who may open the body, who may take a copy out, and where those actions are recorded. The three can point at the same set by name. Which tools the assistant may call stays in the assistant note. See How to set permissions for an enterprise AI assistant and How to attach sources to a knowledge-base reply.
Which documents may stand as the rule is in How to build an enterprise knowledge base. The delivery scope sits under Internal knowledge base and assistant. A file that is withdrawn, or whose review date has passed, does not become the rule again merely because someone may open it. See How to manage document versions in a knowledge base and How to handle stale documents in a knowledge base.
Logical access follows an authorisation that has already been approved
The electronic catalog NIST SP 800-53 Rev. 5.2.0, read on 29 October 2026, is titled Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls. Its metadata last-modified is 2026-10-22, and the version is 5.2.0. The AC-3 statement says to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. The discussion says the policies control access between subjects and objects. A subject is a user, or a process acting for a user. Objects include devices, files, records, and domains. The discussion also says enforcement can sit at the application and service level, not only at the system level, to strengthen security and privacy. Physical entry belongs to the PE family. It is not this note.
The catalog does not name the knowledge base's roles, and it does not prescribe the words used for sensitivity. The company writes the approved combinations: which role, which department, which sensitivity, which set of documents, and which action. A combination that is not on the table is not allowed at the application. An account in the company directory does not, by that fact, have a row.
Search, open, and export are three columns
Search is whether the title and the document identifier are visible. Open is whether the body is visible. Export is whether a copy may leave the library, for example by download or by forwarding. Each column is allowed or not allowed, with who checked it and on which day. A set with any column blank does not enter the documents a reply may cite.
If search is allowed and open is not, the result shows the title and the identifier and does not return the body. If search is not allowed, the document does not appear in results, and a title pasted by someone else does not make it openable. If open is allowed and export is not, the document can be read in the library, and download and forwarding are refused. If all three are allowed, the audit record is still required. Permission does not drop the record.
Role, department, and sensitivity sit on one row
Each row names the role, the department, the sensitivity, the document set, and the three columns. The department uses the unit name the company already uses. Sensitivity uses the company's own short phrase, with who set the scale and on which day. The catalog does not say how many levels there must be. If the same role is both allowed and refused open on the same set, open and export stay suspended until the owner leaves a single row.
A transfer or the end of a project removes the account or the role from that row. The documents are not re-authorised one by one. The assistant note governs accounts inside assistant roles. If a library role and an assistant role share a name, the two tables are still written separately and point at that name. Where the name matches and the three columns do not, the library table decides whether the body may be opened.
Name the events to log, and write why those events are enough
AU-2 in the same catalog says to identify the event types the system is capable of logging for audit, to coordinate with the other bodies that need audit information, to specify which of those types are logged, to give a rationale for why the selected types are adequate for investigating an incident afterwards, and to review and update the selection at an organization-defined frequency. The discussion says an event is an observable occurrence in a system. Its example says an organization may decide the system needs the capability to log every successful and unsuccessful file access, yet leave that capability off except in specific circumstances because of the load on performance. That is the discussion's example. It is not a requirement to log every successful read in the knowledge base.
The company names search, open, and export as the three types to log, and writes the rationale: these three are enough to say, afterwards, who touched the set before a reply left. A blank rationale means the three types are not yet the selected events. The review frequency is written by the company and dated. A blank frequency is not replaced with an invented cycle. The three types that are already named are still logged until the owner writes the frequency.
An audit record answers six questions
AU-3 says an audit record establishes what type of event occurred, when it occurred, where it occurred, the source of the event, the outcome, and the identity of any individuals, subjects, or objects associated with the event. The discussion says the content may include a description, a time stamp, source and destination addresses, a user or process identifier, success or failure, and the filenames involved. It also says an audit trail can reveal information about individuals, especially if it records inputs or is based on patterns or time of use, and that this privacy risk has to be considered.
Each knowledge-base row records whether the action was search, open, or export; the time; the set or the place in the library; which application was the source; whether the outcome was allowed or refused; the account identifier; and the document identifier. The body, and personal data inside the question, are not copied into the audit record. Allowed and refused actions are both recorded. A row with no outcome is not a complete record.
A reply does not leave until the account can open the passage
If a reply is to carry a passage, the account must have open on that document in the authorisation table, and the open must be writable as an audit record. Without open, the reply does not quote the passage. It says the document is outside that account's open right. A citation still needs the path, the version, and the section, and only for current text the account can open. See How to attach sources to a knowledge-base reply.
The actions an assistant may propose still follow the assistant permission table. See How to set permissions for an enterprise AI assistant. A combination of export without open does not stand. Until the owner changes the table, neither column is allowed. Export does not stand in for open.
A set is classified when the columns, the rationale, and the record are written
If search, open, or export is blank, if the rationale is missing, or if an audit record lacks any of type, time, place, source, outcome, or identity, the set does not enter the documents a reply may send.
Three checks show the levels are being managed: every row has the role, the department, the sensitivity, and the three columns; the event types to log have a rationale; and every record can answer the six questions above. A blank item means the reply does not carry a passage from that set.