RAG on ServiceNow: the connector that erases user criteria

A retro of a pilot with Bedrock Managed Knowledge Base's ServiceNow connector: why knowledge_admin plus no document ACL leaks, and how to redesign around it.