Query a RAG knowledge base with Ranger authorization check.

First checks Apache Ranger to verify the user has 'read' access to the specified knowledge base. If allowed, forwards the query to RAG Studio and returns the answer. If denied, returns an access denied message.

Args: user: Username to check permissions for (e.g., 'alice', 'bob'). knowledge_base: Name of the knowledge base to query (e.g., 'Finance KB', 'HR Policies'). query: The question to ask the knowledge base.

Returns: If authorized: The RAG response with answer and sources. If denied: An access denied message with the reason.

List all knowledge bases the user has access to.

Checks Ranger authorization for each knowledge base and returns only those the user is permitted to query.

Args: user: Username to check permissions for.

Returns: List of accessible knowledge bases with their details.

Check if a user has access to a specific knowledge base without querying it.

Useful for pre-flight permission checks before attempting a query.

Args: user: Username to check permissions for. knowledge_base: Name of the knowledge base. access_type: Type of access to check ('read' or 'write'). Default: 'read'.

Returns: Access decision with policy details.

List all Ranger policies for the RAG service.

Shows which users/groups have access to which knowledge bases. Useful for administrators to understand the current access control setup.

Returns: List of policies with their resource definitions and access rules.