Private AI Knowledge Base: Document Search Bound by Access Rules

Document search and AI conversations built around the information each person is allowed to use.

This case study describes a private AI knowledge base for one client's staff. Staff ask questions about their own documents. Each answer keeps its supporting passages beside the conversation. People can attach a file, search a collection they are cleared for, or reopen earlier research through folders and conversation branches.

Administrators pick the models and shared tools each person or group can reach. A workspace can run on the client's own servers. It can still call a model hosted outside, and the chosen provider decides where that request goes.

The challenge

Access to a model is not access to every document. One request can pull in a collection, a prompt and a tool, and each carries its own rules. The checks must run before the assistant fetches material or acts.

There is also an interruption to plan for. The assistant asks for approval, and the user closes the browser before answering.

What we built

An administrator can share a ready model setup with its prompts, knowledge and tools. A new account can be held for approval, and model access is checked before any generation starts.

Tool approvals are stored with the messages they belong to. One endpoint resumes the tool loop after the user answers, even when the connection has dropped and come back. Shared notes and channels let people work together. Scheduled prompts run under their owner's permissions and keep a full history of each run.

Technical approach

Uploaded documents are broken into searchable sections. A content hash flags anything already present, so duplicates are easy to spot. Retrieval can mix keyword and vector search, then rank the passages before they reach the model. Access is checked first, before the collection is even searched. The references then travel with whatever text was picked.

One shared grants table records who may use each resource. A grant names the model or collection, the recipient and the level of access. Creating a folder also needs write access to its collection, and a parent folder must belong to that same collection.

Redis coordinates the workers and the resumable streams. Generation still runs inside the web application, so a reconnect to a stream cannot recover a generation lost during a redeploy. Python plugins run in the server process. Tool creation therefore stays with trusted administrators, and browser-side WebAssembly runs separately without walling those server plugins off.

Project success

An answer reopens with the passages that produced it, so staff no longer copy a lone reply somewhere else to keep it. Pending approvals stay fixed to the conversation that raised them. Knowledge sharing and tool access use one grants model, and every check lands before the assistant reaches a protected resource.

Technology stack

Interface

SvelteKit, Svelte

Backend

Python, FastAPI, asynchronous SQLAlchemy

Storage

PostgreSQL, SQLite or SQLCipher; object-storage adapters

Live communication

Socket.IO, Redis, Yjs

Model and tool interfaces

OpenAI-compatible APIs, Ollama, OpenAPI, MCP

Browser execution

Pyodide, WebAssembly