Buy the permission model, not the retrieval quality. Every platform in this comparison can find the right paragraph. Only one of them re-checks, at the moment of the query, whether the person asking is still allowed to see it. That single difference is what a bank examiner or an HHS auditor asks about first, and it is the one thing you cannot bolt on afterwards.
For a regulated deployment today, the default is Amazon Bedrock Managed Knowledge Base: it is the only platform on this list that validates permissions against the source system at retrieval time rather than against a copy of the ACLs it made earlier. Take Azure AI Search instead if you are a Microsoft shop and can live with a preview API. Take Elastic if the data cannot leave your region. Do not start here with Vectara.
| Platform | Per-user ACLs at query time | Citation evidence | BAA / residency | Published price | Don't pick it if |
|---|---|---|---|---|---|
| Amazon Bedrock Managed KB | Pre-retrieval filter plus real-time check with the source (GA 17 Jun 2026) | Citation precision + coverage metrics, GA | Bedrock is HIPAA-eligible; 8 regions incl. GovCloud | $5/GB/mo + $1 per 1,000 retrievals | Your content lives outside its six connectors |
| Azure AI Search / Foundry IQ | Three identity-native models — ACL/RBAC scopes, Purview labels, SharePoint — all preview; only string security filters are GA | Best evaluator suite (fidelity, NDCG, XDCG, holes) | BAA by default via Product Terms | Per search unit, plus ranker and agentic charges | You need GA terms for the permission feature |
| Google Agent Search | ACLs preview; 3,000 readers/doc; switch is one-way | check grounding returns 0–1 support score + per-claim citations |
Named in the Google Cloud BAA covered list | Per seat, per month; quote only | You may ever need to convert an existing data store |
| Glean | Mirrored source ACLs, best connector coverage | Permission-aware answers; no published groundedness metric | SOC 2 / HIPAA claims live behind an NDA portal | Quote only | Your auditor wants the architecture before signature |
| Elastic | Document- and field-level security you define yourself | None built in — bring your own evaluator | Self-hosted anywhere; you own residency | From $114/mo (Gold; not on Standard) | You have no identity model to map onto documents |
| Vectara | Not a published document-ACL mirroring story | Strongest: calibrated 0.0–1.0 factual consistency score | Enterprise tiers incl. VPC and on-prem | $100K/yr SaaS floor | You are under ~$100K/yr of retrieval spend |
All prices checked 9 August 2026 against each vendor's own pricing page. Normalised workload for the cost column: 1 million documents, roughly 200 GB of raw text, 50,000 retrieval calls a day, 2,000 licensed users, one identity provider, PHI or material non-public information in scope.
The Only Question That Matters at Query Time
A regulated RAG platform is one that can answer "who was allowed to see this document at 14:32 on Tuesday" — and every product here answers it differently. The retrieval engine is a commodity. The permission model is not, because it decides whether your assistant is a productivity tool or an unlogged data exfiltration path with a chat interface.
There are only two designs in the market. Either the platform copies your source system's access control lists into its own index and compares them to the caller's token, or it asks the source system at query time. Almost everyone copies. Copying creates a staleness window: the interval between someone losing access in Entra ID or Epic or Salesforce and that revocation reaching the retrieval index. During that window your platform will happily quote the document to them, with a citation.
Microsoft states the problem in its own documentation, which is more than most vendors do. The Azure AI Search preview notice warns that it "can't modify access permissions that were set outside of the 2026-05-01-preview" and that "a timing lag occurs before the 2026-05-01-preview recognizes changes to those access or permission restrictions" (Microsoft Learn). That is an honest disclosure of a design property, not a bug. It is also the sentence your risk committee should read out loud.
The size of the exposure is not hypothetical. Microsoft's own Copilot deployment blueprint is organised around three pillars, the first of which is literally "remediate oversharing" — the guidance exists because grounding an assistant in years of accumulated SharePoint permissions turns latent governance debt into an immediate, queryable surface (Microsoft Learn). Retrieval does not create the oversharing. It industrialises the discovery of it.
Amazon Bedrock Managed Knowledge Base Is the Default Pick
Amazon Bedrock Managed Knowledge Base closes the staleness window, which is why it wins a comparison it would otherwise lose on flexibility. AWS describes a two-layer model: pre-retrieval ACL filtering narrows the candidate set, and then "real-time access control list (ACL) checks as an additional layer of security" validate permissions directly with the authoritative source during query execution (AWS). It reached general availability on 17 June 2026 across eight regions, including us-gov-west-1 (AWS).
It is also the only platform here with pricing you can put in a business case without a call. Index storage is "$5.00 per GB of raw data / month", standard retrieval is "$1.00 per 1,000 API calls", and agentic retrieval is "$4.00 per 1,000 Agentic Retrieve API calls + $1.00 per 1,000 underlying Retrieve API calls" (AWS pricing, checked 9 August 2026). Parsing, embeddings and re-ranking are included.
Run the normalised workload through that. 200 GB of raw text is $1,000 a month. 50,000 standard retrievals a day is 1.5 million a month, or $1,500. Call it $2,500 a month — about $30,000 a year before a single generation token. Move the same traffic to agentic retrieval and it becomes $8,500 a month, roughly $102,000 a year, which is the moment the seat-priced and floor-priced alternatives stop looking expensive. Decide which retrieval mode your agents actually need before you model the spend, because the two differ by 3.4x.
Two caveats, and the second one matters more than it looks. First, six native connectors — S3, SharePoint, Confluence, Google Drive, OneDrive and a web crawler — plus a direct ingestion API. If your records live in a claims platform or an EHR, you are writing that ingestion yourself, and the real-time ACL check is only as good as the authority you point it at. Second, Amazon Bedrock appears on the AWS HIPAA-eligible services list as "Amazon Bedrock [excluding Fable and Mythos models]", and Bedrock AgentCore is listed separately — but Managed Knowledge Base is not itself named on that list (AWS compliance). Get its eligibility confirmed in writing before PHI touches it. Do not infer coverage from the parent service.
Do not pick Bedrock if your organisation has no AWS footprint. The permission advantage is real but it is not worth a cloud migration, and the connector list is the narrowest here. Be honest about the trade too: asking the source at query time puts that source in the query path, so the design that closes the staleness window also couples your assistant's latency and availability to the system it is asking. A mirrored index degrades toward stale answers when the source is slow or down; a live check degrades toward no answers. Pick which failure your business prefers.
Azure AI Search Has the Richest Permission Model, All in Preview
Azure AI Search offers four distinct approaches to document-level access control, and every identity-native one of them is in preview. That is the whole story. You can use security filters (generally available, but plain string matching that you populate yourself), POSIX-like ACLs and RBAC scopes on ADLS Gen2, Microsoft Purview sensitivity labels, or SharePoint ACLs pulled straight from Microsoft 365 (Microsoft Learn).
For a Microsoft shop this is the most complete model on the market. Query-time enforcement takes the user's token in an x-ms-query-source-authorization header, extracts the user, group and scope claims, and trims results before they reach the model. Purview label enforcement means your existing information-protection classification does double duty. Nothing else here reuses that much of an identity estate you have already paid for.
Pricing is per search unit against a tier that fixes your storage ceiling — 160 GB on Standard S1, 512 GB on S2, 1 TB on S3, up to 4 TB on Storage Optimized L2 — with semantic ranking and agentic retrieval billed on top of the service, after allowances of 1,000 semantic requests and 50 million agentic tokens a month (Azure pricing, checked 9 August 2026). Model the ranker separately. It is the line that surprises people at renewal, because it scales with queries while the tier scales with corpus size.
The compliance problem is that preview and BAA do not compose cleanly. Microsoft's HIPAA BAA is broad and automatic — "execution of customer's volume licensing agreement includes execution of the HIPAA Business Associate Agreement", with in-scope services listed separately (Microsoft Learn). But the ACL features run under the Preview supplemental terms, and the Azure AI Search documentation warns that the preview "supports connections to other Microsoft services and third-party services" whose use "might result in data processing or storage outside of the Azure compliance boundary" (Microsoft Learn). Your GA service is in scope. The feature you are buying it for is governed by different paper.
The operational detail to budget for: SharePoint ACL changes on items with unique permissions are picked up incrementally on each successful indexer run, but changes inherited from a parent scope — a site, library, list or folder — "require an explicit refresh", via /resync with options: ["permissions"] or /resetdocs. Inherited permissions are how most SharePoint estates are actually administered. Someone has to own that resync job, and it should be in the runbook before go-live, not after the first finding.
Do not pick Azure AI Foundry if your compliance function will not sign off on a preview API for an access control boundary. Some will. Ask early — it is a two-week question that can sink a two-quarter programme.
Google Agent Search Is BAA-Covered With a One-Way Switch
Google gets the compliance paperwork right and the migration path wrong. "Agent Search on Gemini Enterprise Agent Platform" is named explicitly in the Google Cloud BAA covered-products list, alongside Gemini Enterprise and the Agent Platform itself (Google Cloud). A product named on the covered list is a stronger position than a product inferred to be in scope, and healthcare buyers should weight that.
Document-level access control attaches an acl_info field carrying user_id and group_id principals, and federates to Microsoft Entra ID, Okta and Ping through Workforce Identity Federation as well as native Google identity (Google Cloud). It is also a Preview offering, with two limits that will shape your architecture: "3000 readers are allowed per document", and — the one that bites — "To set a data source as access-controlled, you must select this setting during data store creation. You can't turn this setting on or off for an existing data store."
Read that twice. A pilot built without access control cannot be promoted. You rebuild the data store and re-ingest. Every proof of concept on Google Vertex AI that skips ACLs "for now" is a pilot you will throw away, and that is exactly how most regulated pilots start.
On citation fidelity Google is strong. The check grounding API returns "a number from 0 to 1 that indicates how grounded an answer candidate is in the provided set of facts", with citations that "connect a claim (typically a sentence) of the answer candidate to one or more of the cited chunks that corroborate the claim" (Google Cloud). Sentence-level attribution is what a reviewer needs to sign an answer.
Pricing is per seat, per month, with pooled storage quotas that vary by edition — 25 GiB on Business, 30 GiB on Standard, 75 GiB on Plus, 2 GiB on Frontline — and Google directs buyers to sales for the rest (Google Cloud). Seat pricing is a headcount bet; consumption pricing is a usage bet. If you are licensing thousands of seats to serve a few hundred daily askers, the arithmetic is against you.
Do not pick Google Agent Search if you cannot commit to the access-control decision on day one.
Glean Wins Connectors and Loses on Disclosure
Glean is the best product here for breadth and the worst for evidence. It mirrors source-of-truth ACLs from every connector it supports and folds users into its own identity schema of groups and memberships, refreshed by periodic crawls (Glean). If your knowledge is scattered across thirty SaaS systems and your alternative is six months of connector work, that is worth a great deal.
The problem is what a regulated buyer can actually read before signing. Glean's security hub describes "permission mirroring, centralized administration, and operational traceability" and offers Glean-hosted and customer-hosted deployment on GCP and AWS — then states that "Compliance documentation (e.g. SOC2) and other content under NDA is available via the Glean Trust Portal" (Glean docs). There is no published list price either.
That is a normal enterprise-software posture and an abnormal one for a control that sits between a clinician and a chart. You can get everything under NDA. Budget the extra procurement cycle, and put the permission-crawl cadence in the contract as a number, because "periodic" is not a control an examiner can test. The same critique applies to Hebbia and the other finance-vertical entrants: excellent domain product, evidence available only after you are already in the funnel.
Do not pick Glean if your security review requires architecture documentation before commercial engagement, or if you need a defensible unit price for a capital request.
Elastic Is the One You Can Run Yourself
Elastic is the answer when the data physically cannot leave your infrastructure, and it is the only option here where that is straightforward. Document- and field-level security are native, and you define the mapping between your identity model and your documents rather than inheriting a vendor's.
Licensing has a trap worth knowing before you architect. On Elastic Cloud Hosted, the subscription matrix lists "Field- and document-level security" on Gold, Platinum and Enterprise but not on Standard (Elastic), so the entry point for the feature is the second tier rather than the headline one. Published starting prices are $99, $114, $131 and $184 a month for Standard, Gold, Platinum and Enterprise on a 120 GB / two-zone production configuration (Elastic pricing, checked 9 August 2026). On self-managed, the same feature appears only under Platinum — marked existing customers only — and Enterprise (Elastic). Self-hosting to control residency can therefore raise your licence tier. Price both before you choose the deployment model.
Elastic also documents its own leakage boundaries, which is the most useful thing any vendor on this page does. "Document level security doesn't affect global index statistics that relevancy scoring uses"; suggesters, search profiling and the terms enum API stop working; and a restricted user "could still learn about field names and terms that only exist in inaccessible documents" via aggregate queries (Elastic docs). Inference across a permission boundary is a real disclosure channel. Put those three sentences in your risk assessment verbatim and you have pre-answered a question that will otherwise arrive as a finding.
Do not pick Elastic if you do not already run it. You are buying a search engine and building the RAG platform, including the ACL synchronisation, the citation plumbing and every evaluator. That is a team, not a project.
Vectara Loses This Comparison, and Its Best Idea Is Free
Vectara is the clearest loser for this buyer, and it is losing on price and fit rather than on quality. Its enterprise tiers start at "$100K/ year" for SaaS, "$250K/ year" for VPC and "$500K/ year" for on-prem, each for a single deployment (Vectara, checked 9 August 2026). At the normalised workload, Bedrock's published rates land near $30,000 a year. You are paying at least a 3x premium before the first document is indexed, and Vectara publishes no document-ACL mirroring story comparable to the four above.
What Vectara genuinely leads on is the thing everyone else calls "citations" and does not measure. Its Factual Consistency Score, the productised form of the Hughes Hallucination Evaluation Model, returns "a calibrated value" from 0.0 to 1.0 in the factual_consistency_score field (Vectara docs). Note that you must set enable_factual_consistency_score to true — it is opt-in, so an implementation that never turned it on has the feature and none of the benefit.
The open version, HHEM, is published on Hugging Face and you can run it against any RAG pipeline you like. That is the honest recommendation: take the model, not the contract. If you are already spending $250,000 a year on retrieval and want a single vendor to own it end to end, Vectara re-enters the conversation. Below that, it does not.
Your Redaction Does Not Cover Your Logs
Redaction is the control most often assumed and least often verified, and the failure mode is documented in plain sight. Bedrock Guardrails will detect and either block or mask a long list of entities — US_SOCIAL_SECURITY_NUMBER, UK_NATIONAL_HEALTH_SERVICE_NUMBER, CA_HEALTH_NUMBER, INTERNATIONAL_BANK_ACCOUNT_NUMBER, SWIFT_CODE, US_BANK_ROUTING_NUMBER — plus custom regex, on input, output, or both (AWS docs).
Then read the note underneath. "PII masking applies only to content that is sent to the inference model (input prompts) and content that is returned from the inference model (model responses)." It does not apply to model invocation logs, where "the input field in Amazon CloudWatch Logs always contains the original, unmodified request regardless of guardrail intervention." Nor to the guardrail trace: the match field "contains the original PII value, not the masked output", by design, so your application can act on the detection.
So the answer is masked, the log is not. If you enabled invocation logging for auditability — which every regulated deployment does — you built a second, unredacted copy of every prompt containing a patient identifier or an account number, in a system with a different retention policy and a different access model from the one you just reviewed. Fix it with log data protection at the CloudWatch layer, and check the equivalent path on whichever platform you choose. This is not an AWS-specific flaw; it is what happens everywhere the redaction control and the observability control are owned by different teams.
What Evaluation Evidence an Auditor Accepts
An eval is a repeatable test that scores your retrieval and generation against labelled examples, and it is the only artefact that turns "the assistant seems accurate" into something a regulator can examine. HIPAA's technical safeguards already require audit controls — mechanisms that record and examine system activity (HHS) — and the same instinct now applies to answer quality.
The three hyperscalers differ sharply in what they hand you. Azure is furthest ahead: its Document Retrieval evaluator produces Fidelity, NDCG, XDCG, Max Relevance and Holes against human relevance labels, with Groundedness, Groundedness Pro, Relevance and Response Completeness on the generation side (Microsoft Learn). "Holes" — documents with missing relevance judgments — is the one to watch, because it measures the quality of your test set rather than your system, and a test set nobody has labelled properly is the most common reason an evaluation programme quietly stops meaning anything.
AWS made RAG evaluation generally available with context relevance and coverage for retrieval, correctness, completeness and faithfulness for generation, and in the same release added citation precision and citation coverage (AWS). Those two are the pair a reviewer cares about: precision asks whether the citations support the claim, coverage asks whether every claim carries one. An answer with a footnote nobody checked is worse than an answer with none, because it borrows authority it has not earned.
Whatever you buy, the evidence pack is the same four things: a labelled evaluation set that a subject-matter expert signed, scores per release with the threshold written down in advance, the citation precision and coverage numbers, and an access-review log showing that a user who lost source access stopped getting results. Only the last one tests the control this entire comparison turns on, and almost nobody runs it.
What Should Change Your Answer
Four conditions flip the recommendation, and none of them is retrieval accuracy.
Where your documents already live. The connector list decides more than the ranking algorithm. If your corpus is SharePoint and OneDrive, Azure's native ACL path removes work no benchmark will show you. If it is thirty SaaS systems, Glean's coverage is worth its opacity.
Whether your compliance function accepts preview terms. Azure and Google both put document-level ACLs behind preview status. That is a governance decision, not a technical one, and it is the fastest way to find out whether your programme is real.
Seats versus calls. Per-seat pricing bills your headcount; consumption pricing bills your traffic. With 2,000 licensed users and 50,000 retrievals a day, consumption wins comfortably. Invert those ratios — a small team of heavy agentic users — and it reverses, which is the same crossover that governs LLM gateway buying decisions.
Whether you can rebuild. Google's one-way access-control switch means the cost of getting it wrong is a full re-ingest. On a million documents that is not a sprint.
What should not change your answer: a vendor benchmark on retrieval quality. Every platform here retrieves well enough, and none of the differences survive contact with your actual chunking strategy. If you want to test something, test the vector store underneath and the revocation path above it.
Three Things to Do Before You Sign
This week: Run the revocation test. Pick a real user, remove their access to one document in the source system, and time how long the platform keeps returning it. Every vendor on this page will quote you a number. Measure it yourself, in your tenant, with your connector. That measurement is your actual control boundary and it belongs in the contract.
This month: Get the compliance status of the specific feature in writing, not the parent service. "Amazon Bedrock is HIPAA-eligible" is not the same statement as "Managed Knowledge Base is HIPAA-eligible". "Azure is in BAA scope" is not the same as "the 2026-05-01-preview ACL feature is in BAA scope". Ask both questions by email and keep the reply.
Before you sign: Build the evidence pack against a shortlist of two. A labelled evaluation set signed by a subject-matter expert, citation precision and coverage scores, and an access-review log. If a vendor cannot produce those from a 30-day trial, they will not produce them during an examination either.
The Bottom Line
Enterprise search has been sold on relevance for twenty years, and relevance is now free. What is scarce, and what regulated buyers are actually purchasing in 2026, is an access control decision that holds up when someone asks who saw what and when. Bedrock leads because it asks the source instead of trusting a copy. Azure has the better model on paper and the wrong terms on it. Google has the paperwork and a switch you can only throw once. Glean has the connectors and an NDA. Elastic has your data centre and none of the platform.
The retrieval engine is a commodity. The permission model is the product. Buy that.
Continue Reading
- Pinecone vs Weaviate vs pgvector: Stay on Postgres
- Snowflake Cortex vs Databricks Mosaic AI: Pick on Exit Cost
- Datadog vs Arize vs LangSmith: Buy on the Billing Unit
- Hospitals Test Vendor AI. Fewer Than Half Have a Sandbox.
- Why 20 Banks Chose MongoDB to Fix Enterprise AI Retrieval
- EU AI Act Governance Tools: Buy Inventory, Not Policy Packs
- RAG Fails 40% of the Time. The Fix Isn't a Better Model.
- Best LLM Gateways for Cost Control: Self-Host First