# Azure OpenAI Assistant Exposed a Retrieval Security Blind Spot That One Filter Fixed

Egiziago Cioffi, CEO of SynSphere Italia, a Microsoft partner in Milan, built an Azure OpenAI email assistant that auto-resolves roughly 60% of customer emails. His team ran evaluations. Unit tests passed. Everything looked solid until he asked one question that changed everything.

He tested the assistant with a low-privilege account against the same queries a high-privilege account had already submitted. The outputs diverged. The low-privilege user received SharePoint content they should never have accessed. The retrieval pipeline had a security gap nobody caught because standard evaluation frameworks don't test what happens when users with different permission levels ask the same questions.

This is a core problem in production AI systems. Azure OpenAI's retrieval mechanisms, connected to enterprise data sources like SharePoint, inherit access control from those sources. In theory. But Cioffi's experience shows that theory and practice diverge when an assistant operates across multiple permission contexts without explicit filtering.

The fix was not complicated. Cioffi didn't build a new identity platform. He didn't overhaul the retrieval architecture. He added one filter that narrowed the assistant's scope and cross-checked every retrieval result against the requesting user's actual SharePoint permissions before returning any content. The assistant learned to say no to users who had no right to see specific documents.

His email assistant still auto-resolves at 60%, but now it respects boundary conditions.

The lesson extends beyond email assistants or Azure OpenAI. Any retrieval augmented generation (RAG) system connected to enterprise data inherits a security debt. Developers focus on retrieval accuracy, relevance scoring, and hallucination prevention. They evaluate whether the system returns the right information. They rarely evaluate whether it returns the right information to the right person.

Standard LLM benchmarks and evaluation frameworks test model capability in isolation. They don't test access control integration. They don't simulate multi-tenant scenarios where different users have different data visibility. A system can score high on retrieval quality and still leak information horizontally across privilege boundaries.

Cioffi's approach surfaces an operational reality: enterprises using AI assistants built on top of SharePoint, Azure SQL databases, or other permission-aware systems need evaluation protocols that include access-control testing. The indexing job that feeds the RAG pipeline must coordinate with identity systems. The assistant must validate that every document it retrieves is actually viewable by the user who asked.

For developers building AI assistants inside Microsoft's ecosystem, this carries specific weight. Azure OpenAI integrates with Entra ID and SharePoint access controls, but integration is not enforcement. A developer must explicitly encode permission checks into the retrieval logic. Off-the-shelf retrieval templates won't do it automatically.

SynSphere Italia's fix came down to narrowing scope and adding validation. That works. But it also points to a wider adoption risk as enterprises roll out AI assistants at scale. They inherit all the complexity of enterprise identity management without always recognizing the dependency. A gap in one costs data.