Who may see what

Make an agent that serves many people show each person only the documents they may see, even though the agent itself can read them all.

Before you start: your retrieval needs to know who is asking, for example the signed-in user's email.

Add the people and teams
Go to Settings → Data access and press + Add a person or group. Give their email or team name, the teams they belong to, and any sensitive categories they are cleared to see.
Grant them sources
Press + Add a grant. Pick the source (a name or a pattern such as kb/support/*) and the person or team. Tick a sensitive category only if the grant covers one.
Anything without a grant is hidden from everyone. A sensitive category, such as insider financial information, also needs the matching clearance on the person.
Filter retrieval for the caller
Between retrieval and the model, send the caller and the retrieved chunks to POST /api/entitlement/filter. Use the chunks it returns as the model's context. With agentfox.auto(), pass agentfox_principal and agentfox_chunks on the model call instead.
python
```
client.chat.completions.create(
    model="gpt-4o-mini", messages=messages,
    agentfox_principal="ana@example.com",
    agentfox_chunks=chunks,
)
```
Check what was held back
Once checks run, the page shows how much content was held back and why. That share is what the agent could reach and the caller could not. It is not an error rate.
bash
```
agentfox report entitlement
```

Which sources to trust

Settings → Verified sources records how far each source can be trusted (system of record, approved, unverified, external), who owns it and how fresh it must be. Press + Add a source to register one. An answer built on a deprecated or stale source raises an Issue.

Settings, Verified sources: registered data sources with their tier, owner and freshness.

To make the agent say it does not know instead of guessing, see Custom rules.

If something goes wrong

You see	Do this
Nobody is being checked yet	People and grants do nothing alone. Your retrieval must call the filter.
unknown principal	Add that person first, or add them from your sign-in code.
A grant has no effect	The team name must match exactly, and the pattern must match the source each chunk carries.

Who may see what

Make an agent that serves many people show each person only the documents they may see, even though the agent itself can read them all.

Before you start: your retrieval needs to know who is asking, for example the signed-in user's email.

Add the people and teams

Go to Settings → Data access and press + Add a person or group. Give their email or team name, the teams they belong to, and any sensitive categories they are cleared to see.

Settings, Data access: the people and groups who call the agent, and which data each may see.

Grant them sources

Press + Add a grant. Pick the source (a name or a pattern such as kb/support/*) and the person or team. Tick a sensitive category only if the grant covers one.

Anything without a grant is hidden from everyone. A sensitive category, such as insider financial information, also needs the matching clearance on the person.

Filter retrieval for the caller

Between retrieval and the model, send the caller and the retrieved chunks to POST /api/entitlement/filter. Use the chunks it returns as the model's context. With agentfox.auto(), pass agentfox_principal and agentfox_chunks on the model call instead.

python

client.chat.completions.create(
    model="gpt-4o-mini", messages=messages,
    agentfox_principal="ana@example.com",
    agentfox_chunks=chunks,
)

Check what was held back

Once checks run, the page shows how much content was held back and why. That share is what the agent could reach and the caller could not. It is not an error rate.

bash

agentfox report entitlement

Which sources to trust

To make the agent say it does not know instead of guessing, see Custom rules.

If something goes wrong

You see

Do this

Nobody is being checked yet

People and grants do nothing alone. Your retrieval must call the filter.

unknown principal

Add that person first, or add them from your sign-in code.

A grant has no effect

The team name must match exactly, and the pattern must match the source each chunk carries.