# Amazon Bedrock adds fine‑grained ACL control to Managed Knowledge Base

> AWS blog shows how to limit each agent’s search to documents a user is allowed to see using ACL‑aware knowledge bases and a gateway interceptor.

Oossa · 2026-11-12 · https://oossa.com/en/amazon-bedrock-adds-fine-grained-acl-control-to-managed-knowledge-base

AWS announced a pattern that lets a single Bedrock agent serve many users while only returning documents each user can view. The solution injects the signed‑in user's email from a Cognito JWT into the tool call, then relies on Managed Knowledge Base’s ACL awareness to filter results. A Lambda interceptor and a Cedar policy verify the injected userContext before the search reaches the knowledge base.

## The facts

- Blog posted on 2026-11-12
- Uses Claude Sonnet 5.5 as the default model

## Why it matters

Enterprises can deploy shared AI assistants without risking accidental data leakage between departments or SaaS customers.

## Sources & references

1. [Fine-grained access control for Amazon Bedrock Managed Knowledge Base tools](https://aws.amazon.com/blogs/machine-learning/fine-grained-access-control-for-amazon-bedrock-managed-knowledge-base-tools/) – AWS, 2026-11-12

Last updated: 2026-11-12