Every group sees only its own knowledge
KOSMO controls access through groups: files are assigned to a group, and staff only receive answers from the sources their group is cleared for. That way the same assistant can serve HR, accounting and sales without anyone seeing content that is not meant for them.
Permissions by group rather than per person
You create groups as they already exist in your organisation – accounting, HR or sales, say – and assign the uploaded files to the matching groups.
When someone asks a question, KOSMO only draws on the sources that person is cleared for through their group. Confidential documents appear for others neither in the answer nor in the source reference.
The practical advantage over per-person permissions: when people join or leave or change department, you change the group membership – not dozens of individual clearances.
Why this matters
HR, salary or contract documents stay limited to the groups already allowed to see them.
Permissions hang on the role in the organisation, not on individual people.
New staff join their group and immediately have the right level of knowledge – no more and no less.
A traceable permissions concept is a precondition for deploying an AI assistant in a GDPR-compliant way.
Role-based access control as a precondition for GDPR-compliant use
An AI assistant that serves every document to every member of staff is barely defensible in data protection terms. The GDPR requires that personal data is accessible only to those who need it for their task. Without a permissions concept that cannot be evidenced – and it is precisely here that many AI pilot projects fail at the second step.
The technical term for this is role-based access control (RBAC): permissions hang on a role or group, not on individual people. A short explanation is also in our AI glossary.
In practice that means: someone leaving, a change of department or a cover arrangement is a change to group membership – not a round of updating dozens of individual clearances, in which experience says one gets forgotten.
For professionals bound by confidentiality under section 203 of the German Criminal Code – law firms, medical practices, tax advisers – there is the added point that client and patient data has to be separated not only from the outside world but internally too. Which other requirements apply is set out under What is a GDPR-compliant chatbot?.
Häufige Fragen
Can a person be in several groups?
Yes. Anyone belonging to several groups receives answers from all the sources cleared for those groups – which is how you cover managers or assistants looking after several areas.
Can you tell that documents exist which you are not allowed to see?
No. Sources outside your own groups feed neither into the answer nor into the source reference.
What is role-based access control?
A permissions concept in which rights hang on roles or groups rather than on individual people. There is more on this in the glossary.
Can this be connected to our existing user management?
KOSMO uses central sign-in via Keycloak. How that connects to your existing user management is clarified during the project.
How many groups make sense?
As many as there are professionally separate areas of knowledge – usually you mirror the existing organisational structure. Overly fine-grained models tend not to be maintained and lose their purpose as a result.
Do the permissions also apply to connected cloud folders and emails?
Yes. Permissions apply regardless of where a source comes from – including connected folders from your knowledge cloud and connected mailboxes.
What happens when someone leaves the company?
Access is withdrawn through central sign-in, and group membership ends with it. No individual clearances are left behind for someone to clean up separately.
What else KOSMO can do
Watch websites and get reminded when your keywords appear.
Connect Nextcloud and OneDrive folders as a knowledge source.
Connect emails and send answers straight out.
Every answer with evidence – read it in the document itself.
KOSMO on your phone, with push notifications.
Induction, training and internal information in one place.
Best seen for yourself
In 30 minutes we'll show you what this feature looks like in your working day – with your own content.
