Manage Knowledge Access Policies

What an access policy does

An access policy decides what happens when a user's role is not allowed to use protected Knowledge content. A policy can be assigned to a whole document, one page, or selected content nodes in Pipeline Studio.

This page manages policy definitions. It does not assign a policy to content. For assignment, return to the document's Access Policy step in /knowledge-documents.

Open the page

1. Open Knowledge Documents.
2. Click Manage Policies in the Documents header.

The page heading is Knowledge Administration, and the main section is Access Policies. Use Back to return to the previous page.

If the Knowledge service is disabled, the page shows a warning and prevents create, edit, and delete actions until the service is available again.

Read the Access Policies table

The table shows:

The current create/edit dialog does not contain controls for Active or Default. Those values are shown in the table but are managed by the system or its administrative configuration.

Understand classifications

Classification communicates the sensitivity of the protected content:

Classification is a label within the policy. Access is enforced through Allowed Roles and the selected Deny Action.

Understand deny actions

Choose Hidden when even the existence of the result should not be exposed, Soft Deny when the user should understand that access is restricted, and Masked only when a safe redacted form is useful.

Create a policy

1. Click Create Policy.
2. Enter a required Policy Name.
3. Select Classification.
4. Select Deny Action.
5. Select any required Allowed Roles.
6. If Masked is selected, enter valid Masking Rules (JSON).
7. Click Create.

Select allowed roles

Use Search roles to filter the available list. Click a role to select or remove it. Selected roles appear as chips above the list.

The role picker also provides:

• Select all;
• Deselect all;
• remove on each selected-role chip; and
• Clear all.

Leaving Allowed Roles empty means all roles are allowed. It does not mean that nobody is allowed. Always add at least one role when the policy is intended to restrict content.

Enter masking rules

Masking Rules (JSON) appears only when Deny Action is Masked. Enter a valid JSON object that identifies the fields and replacement text to use. For example:

{
  "email": "***@***",
  "phone": "***"
}

The page validates the JSON while you type. Create or Update remains disabled when the JSON is invalid.

Edit a policy

1. Find the policy in the table.
2. Click Edit.
3. Change the name, classification, deny action, roles, or masking rules.
4. Click Update.

The update changes the shared policy definition. Content assigned to that policy uses the revised rule for future processing and searches. If already embedded content must receive updated access metadata, open each affected document and use Sync Access in Pipeline Studio.

Delete a policy

1. Click Delete for the policy.
2. Review the Delete Policy? confirmation.
3. Click Delete to confirm.

Deletion is a soft delete. Documents using the removed policy fall back to the policy marked Default. Review that default policy before deleting a restrictive policy so content does not receive an unintended fallback behavior.

Apply a policy to content

Return to /knowledge-documents, select a document, and open Access Policy. You can then assign the policy at:

• Document level;
• Page Override level;
• Node Override level; or
• Smart Assign for sensitive-information and entity matches produced by Stage 4: LLM Enrichment.

After changing access on an already embedded document, click Sync Access so the current search index receives the new policy metadata.

Important safeguards

• Keep policy names short and specific, such as HR Confidential or Internal Procedures.
• Treat an empty role list as broad access.
• Use the smallest role list needed for confidential or restricted content.
• Validate masking with real sample questions before relying on it.
• Check the fallback policy before deleting any policy.
• Do not assume the classification label alone grants or blocks a role; review Allowed Roles.

Troubleshooting