Closing an Azure OpenAI assistant's retrieval gap didn't take a new identity platform. It took one filter and a narrower assistant.

Egiziago Cioffi built an Azure OpenAI email assistant that resolved about 60% of inbound messages, but when tested with a low-privilege account it returned SharePoint documents the user could not access, exposing a retrieval-entitlement gap. Microsoft’s Azure AI Search now supports document-level ACL trimming via Entra tokens, yet many deployments—including custom pipelines like Cioffi’s—still lack query-time entitlement checks, leading to widespread silent data exfiltration in production agents.