Understanding knowledge source permissions in employee service AI agents (EAP)

For employee service (ES) AI agents, Knowledge admins can connect knowledge sources and make them available to specific groups or to all users.


What's my plan?







Employee Service Suite

Growth, Professional, Enterprise, or Enterprise Plus







Summary: ◀▼
You can connect knowledge sources to employee service AI agents and control user access based on permissions in the source app and connection settings. Sources can be set to open visibility, allowing broad content discovery but requiring source app access for full use, or restricted visibility, limiting results to authorized content only. Managing these permissions helps maintain information security and ensures users see relevant, accessible resources.




For employee service (ES) AI agents, Knowledge admins can connect knowledge sources and make
them available to specific groups or to all users.
Connected knowledge sources allow users to access information when they search in the help
center or when they engage with an ES AI agent in Slack or Microsoft Teams, based on their
permissions in the connected app where the source information lives, and the permission set in
the connection by the Knowledge admin. Users can click through to the source if they have
source access permissions. For most apps, admins can restrict permissions for app resources.
These are known as permission-based sources.
Knowledge admins can edit any connected source, but the results they receive as end users of
ES AI agents still rely on the source permissions if the source connection uses a
permission-based setting.
This article contains the following topics:

Understanding sources with open to everyone
visibility
Understanding sources with
restricted access visibility
Understanding source permissions
with examples



Understanding sources with open to everyone visibility

By default, all connected apps, with the exception of Notion, are set to Restricted access
visibility. However, admins connecting sources can change visibility to Open to everyone, so
that users who receive access to the source can view the content served by the ES AI agent.
Users' ability to click through to these resources, though, depends on both access to the
source app and their permissions in that app. Clicking a specific resource in the ES AI
agent answer redirects users to the original app, where the app's access rules are applied.
For example, if a Jira project is indexed in a connection with Open to everyone visibility,
all users given access to that connection can see results from that Jira board in the ES AI
agents response, but users can click through to the source only if they have a Jira license,
and then if they have access to view that project within Jira.
It's important to carefully manage the permissions at both the source and within the
connected sources to maintain information security within your company.



Understanding sources with restricted access visibility

Permission-based visibility, or restricted access, for connected sources provides a more
restricted and controlled experience. When you apply this type of visibility, users assigned
access to the source can search for, find, and open only the resources they are authorized
to access within the app where the resources live. In other words, the ES AI agent respects
the access permissions set within the connected app when providing a response. This is also
called resource-level permissions (RLP).
Permission-based sources are supported for these apps:


Box
Confluence
Google Drive
SharePoint
Slack
Microsoft Teams





Examples for understanding source permissions

Consider that you are a Knowledge admin for ES AI agents, and you want to connect a Google
Drive as a knowledge source. In this scenario, you could create three different types of
sources:



Source with open to everyone visibility When the end user asks an ES AI agent
a question, they see the content and titles of the resources in the indexed Google
Drive in the agent’s source citations provided with the response. They can also
preview these resources. However, if they try to open a resource and don't have access
permissions in the Google Drive, they'll need to request access from the drive owner.
This helps end users discover resources relevant to their question that they were
previously unaware of, potentially helping them with tasks.


Source with restricted access visibility Sharing this source with all your
company's users ensures that end users see only resources in their results that they
have access to in the indexed Google Drive. ES AI agents filter out any resources the
end user doesn't have permission to view, ensuring they are granted access only to
documents aligned with their existing permissions in Google Drive.


Source with open to everyone visibility, some restricted source
permissions Sharing this source with everyone when it is not intended for them
means that you are relying on the permissions at the source being enforced. It is
recommended, instead, that the knowledge source permissions applied to the connection
match those in the source as closely as possible. For example, a Google Drive that is
restricted to members of your Finance department should have Restricted access
visibility selected in the knowledge source connection.





{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/10861075146778",
"url": "https://support.zendesk.com/hc/en-us/articles/10861075146778",
"headline": "Understanding knowledge source permissions in employee service AI agents (EAP)",
"description": "You can manage knowledge source permissions for employee service AI agents by setting visibility to open or restricted access, ensuring users see only content they are authorized to access based on source app permissions.",
"articleSection": "Connecting sources",
"datePublished": "2026-06-03T17:53:35+00:00",
"dateModified": "2026-07-31T22:50:48.922952+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/10861075146778"