PRODUCTION SCENARIO
A Generative AI Engineer deploys a document assistant whose users each hold different Unity Catalog permissions on the source documents. Every user currently sees the same retrieved documents, because the agent reads the index with the deploying engineer's access.
How should the engineer change the deployment?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Use on-behalf-of-user authentication so the agent runs as each caller
On-behalf-of-user authentication runs the agent with the permissions of the end user making the request, which is what makes retrieval reflect each caller's own grants. Automatic authentication passthrough is the behaviour the scenario already describes: the agent runs with the permissions of the user who deployed it. A service account token gives every caller one shared identity, and a row filter applied at sync time runs as the syncing identity, so a single filtered copy lands in the index for everyone.