Choosing an AI Knowledge Platform for Per-Space Permissions and Audit Reporting
AKB uses vaults as access-control boundaries and provides document revision history; optional MCP audit output can feed external reporting, with defined scope and best-effort limits.
Key Takeaways
- Configure vaults for the boundaries you need: Vaults are AKB's access-control boundary; use separate vaults and access grants to separate teams or projects.
- Use document revision history to review edits and understand how a decision changed.
- Enable MCP audit and external reporting when needed: Optional MCP audit output can be collected and reported on by an external SIEM or operator.
When teams connect AI agents to shared knowledge, they need to decide which people and agents can access each body of content—and what evidence they can use to review activity. In AKB, vaults define access boundaries, document revision history helps inspect edits, and optional MCP audit output can be sent to external reporting tools.
How Do Vault Permissions Work?
A vault is AKB's access-control boundary; a collection is a way to organize content inside a vault, not a separate permission boundary. To separate teams or projects, configure distinct vaults and grant access to the intended users or organizations. For example, an engineering vault can hold restricted project material while a shared-handbook vault is granted to a broader group. AKB does not automatically mirror permissions from source systems.
For akb_sql, PostgreSQL user and vault roles enforce access to AKB-managed tables and reject unauthorized vault references. This is not arbitrary row-level policy, and AKB does not manage permissions for an external SQL database. See the AKB key concepts for the vault model and SQL boundary.
What Can You Review or Report?
| Capability | What it provides | Scope to keep in mind |
|---|---|---|
| Access enforcement | Vault configuration and access grants define who can access the knowledge in each vault. | Collections organize content within a vault; they do not create a new access boundary. |
| Document revision history | Inspect revisions to review document edits. | Document revision history; history for other resource types varies. |
| Optional MCP audit output | When enabled, AKB emits structured, append-only, hash-chained JSONL at MCP dispatch. An external SIEM or operator collects it and handles querying, reporting, and retention. | Disabled by default and best-effort; scoped to MCP dispatch, not a complete record of all system access. AKB produces the output but does not store, query, or retain it. See Audit log (optional). |
| Resource-change events | Change notifications can be delivered through the event fanout for external consumers. | Notifications are not a complete audit trail or permanent history. See Event fanout (optional). |
How Does AKB Organize Knowledge?
AKB serves documents, tables, and files to agents through MCP, with hybrid semantic and keyword search. Documents can define explicit relations to other items, forming a useful knowledge graph. AKB keeps the core focused on reading and writing knowledge, so teams can add curation through external workers or integrations.
Coding-session notes can be captured with the akb-sessions plugin when the relevant agent integration is configured. Keep private session memory and shared team knowledge in their intended vaults and access scopes rather than assuming that using the same backend makes them visible to the same people.
How should we separate team or project knowledge?
Use vaults as the access boundaries: configure separate vaults for the teams or projects that need separation, then grant access to the intended users or organizations. Collections organize content within a vault but do not provide a separate permission boundary.
Does akb_sql manage an external database or provide row-level permissions?
No. akb_sql applies PostgreSQL user and vault roles to AKB-managed tables and rejects unauthorized vault references. It does not manage an external SQL database's permissions or provide arbitrary row-level policies.
How can we produce an audit report, and are resource events a substitute?
Enable optional MCP audit output and have an external SIEM or operator collect, query, report on, and retain it. Resource-change events are notifications, not a substitute for audit reporting.
Review AKB's permission and audit setup
Read the current AKB README for vault permissions, document revisions, MCP audit output, and event fanout.