Permissions-aware RAG

Use Glean's Platform API as the retrieval layer for your own LLM app — every chunk ACL-filtered per user before it ever reaches the model.

~1 hrIntermediate

Problem

Building RAG over your own content usually means standing up a vector DB, mirroring every source system's ACLs into it, and keeping that mirror in sync forever — get any of that wrong and you leak documents. Glean is already the permission-aware index of your company's content. Use its Platform API as retrieval and skip all three problems.

Architecture

Your appany LLM app

Glean Platform APIACL-filtered retrieval

Your LLManswers from permitted context only

Prerequisites

A Glean token with SEARCH scope (global/admin token for the act-as permissions demo)

X_GLEAN_INCLUDE_EXPERIMENTAL=true set (the Platform API is Experimental as of its 2026-07 launch)

An LLM API key (any provider; example uses Claude)

Python 3.10+ or Node 20+

Steps

1

Pick a language

Both variants implement the same flow — pick whichever fits your app's stack.

Python

1

Scaffold the project

npx tiged --mode=git gleanwork/glean-cookbook/recipes/permissions-aware-rag/python permissions-aware-rag

2

Install dependencies

cd permissions-aware-rag && pip install -r requirements.txt

3

Set credentials

Fill in GLEAN_API_TOKEN, GLEAN_INSTANCE, and ANTHROPIC_API_KEY, then export them into your shell — unlike the TypeScript variant, this one reads the environment directly and does not load .env automatically.

cp .env.example .env

4

Run it

python main.py "What's our PTO policy?"

5

Verify

Confirm the printed answer carries numbered citations with real titles and URLs. Re-run with --act-as <restricted-user-email> (requires a global/admin token) and confirm an HR-only query returns no fabricated answer for that user.

TypeScript

1

Scaffold the project

npx tiged --mode=git gleanwork/glean-cookbook/recipes/permissions-aware-rag/typescript permissions-aware-rag

2

Install dependencies

cd permissions-aware-rag && npm install

3

Set credentials

Fill in GLEAN_API_TOKEN, GLEAN_INSTANCE, and ANTHROPIC_API_KEY — loaded automatically via dotenv in this variant.

cp .env.example .env

4

Run it

npm start -- "What's our PTO policy?"

5

Verify

Confirm the printed answer carries numbered citations with real titles and URLs. Re-run with -- "<question>" --act-as <restricted-user-email> (requires a global/admin token) and confirm an HR-only query returns no fabricated answer for that user.

Take it further

Add a re-ranking pass over snippets before they reach the LLM for higher-precision citations.

Cache retrieval results per session to cut latency on follow-up questions in the same conversation.

Swap in Glean Chat instead of a raw LLM call if you want Glean to also own the generation step.

Scaffold starter code

Copies a prompt your AI assistant can build from.

At a glance

SurfacesPlatform API, API clients

StatusProduction pattern

Time~1 hr

Required scopes

SEARCH

Code assets

Platform API search.query → snippets → LLM with citationsSame flow in TypeScript