Path-Based Access Control (Connector Filters)

While connectors like SharePoint and Google Drive provide base permissions, they are often too broad. Path-Based Access Control (PBAC) allows Admins to enforce stricter visibility by scanning file paths for keywords and requiring matching User Attributes (e.g. user.country, user.manager) for access.

---

How It Works

PBAC operates in two phases:

1. Stamping (at sync). Each article's path — its folder hierarchy plus the article name — is matched against your configured rules. Every rule that matches stamps the article with the attribute and value defined in that rule.
2. Enforcement (at query). When a user asks a question, an article is eligible to answer it only if the user's profile satisfies every attribute stamped on that article.

Stamping happens once per sync rather than per query, which is why rule changes require an explicit sync — see The Sync Process.

---

Configuration

Path: Settings > General Settings > Article Visibility > Path based access control

To define a rule, configure the following three components:

1. Path Keywords: Multi-value text input (Chips). Define the strings to look for in the file path (e.g. Finance, Payroll).

2. User Attribute: Single-select dropdown of available user parameters.

3. Required Value: The specific value the user must have to satisfy the filter.

You can define multiple rules against the same attribute. Rules that match the same article are consolidated per attribute, so an article matched by both a Japan rule and a Singapore rule mapped to user.country is stamped with both values on that one attribute.

---

Keyword Matching

Keywords are matched against the article's full path, which includes both the folder hierarchy and the article name.

• Whole-word matching. The path is split on slashes, spaces, hyphens, underscores and commas, and each segment is compared case-insensitively against your keywords. Matching is on complete words, not substrings — the keyword art will not match the folder Department.
• CamelCase is split automatically. A folder named CanadaBenefits is read as Canadaand Benefits, so the keyword Canadamatches it.
• Multi-word keywords. A keyword containing a space (e.g. Rhode Island) is additionally checked as a case-insensitive phrase against the full path, so it matches folder names that keep the words together.

Recommendation: include every naming variant your source system actually uses. If your Drive contains India, INand APAC-India folders, all three belong in the keyword list for the same rule.

---

Logic & Evaluation

A user can retrieve an article only if they satisfy every attribute stamped on it. Within a single attribute, any one of the listed values is sufficient.

Example. An article stamped with user.country = IND, USA and user.designation = Manager is retrievable only by a user who is a Manager and based in India or the USA.

Unstamped articles and missing user attributes

Two fallbacks govern the edges. Both are deliberate:

---

The Sync Process

Permissions are stamped onto articles via a manual sync to ensure high performance at runtime.

• Trigger: Click the Save ---> Save and Sync button after modifying rules.
• System State: The configuration page becomes Disabled (Grayed out) during execution.
• Progress: An infobar appears showing "Filters are being applied across your articles. This may take several minutes."

Rule changes do not take effect until this sync completes. During the sync, articles retain their previously stamped filters, so access is never interrupted mid-run.

---

Environment Behaviour

To maintain architectural consistency, UAT is treated as a downstream mirror of Production.

---

Monitoring & Debugging

Article Details Page

Admins can view active filters directly on an article's Details page under the section Path Based Filters. This is the fastest way to confirm whether a rule matched a given article.

Common Scenarios

---

Query Pipeline & Access Control

Enforcement happens at query time and closes the loop opened at sync time: an article is eligible to answer a user's question only if that user's profile parameters satisfy the filters stamped on it. See Logic & Evaluation for the exact matching rules.