AI Agents and Data Permissions: Enforcing Who Can See What

An AI agent should only access data through an execution path that enforces the relevant user's permissions. A prompt telling it to respect confidentiality is useful guidance, but it does not create that enforcement.

The boundary must cover queries, retrieved documents, cached results, and operational traces. Otherwise, a correctly filtered database query can be undermined by an unfiltered cache or a broadly accessible log.

Follow identity from the user to the data

Consider a customer-facing analytics assistant. A user from tenant A asks for monthly sales. The application authenticates the user and establishes their tenant and role. The query service then applies the allowed scope when executing the request.

Do not trust tenant_id solely because the model included it in a tool call. Treat model-generated arguments as requests that require validation. The authenticated session determines the maximum permitted scope, regardless of what appears in the question.

The precise implementation may use database row policies, a trusted query service, or platform-level model restrictions. Document which layer is authoritative and test that all available tool paths pass through it.

The cache failure that bypasses a correct query

Suppose the first user asks “sales last month” and receives a scoped result. The application caches that answer under the normalized question. A second user from another tenant asks the same question and receives the first user's number.

The database policy worked. The cache key did not distinguish authorization scope.

Include the relevant tenant, permission context, metric version, and period in cache partitioning, or avoid shared caching where you cannot guarantee equivalent access. Also define invalidation when permissions change. A previously authorized result is not necessarily authorized forever.

Check more than row filters

Surface	Question to test
Query tools	Can a user request another tenant or bypass the approved model?
Documents	Are access restrictions applied before passages reach the model?
Aggregates	Can restricted attributes or small groups be inferred from results?
Cache	Can users with different permissions receive each other's answers?
Traces	Who can read prompts, returned rows, and query results?
Background jobs	Which identity and scope does a scheduled agent use?

A shared service account may be appropriate for a specific internal job, but its scope should match that job. Reusing an unrestricted account for every interactive user shifts the full access-control burden to the application.

Model permissions and content permissions differ

The ability to open a saved report is not necessarily permission to query every underlying field. Conversely, hiding a field in the interface does not automatically remove access through an API.

Review the chosen platform's enforcement semantics. Our Omni access-management guide and Looker permissions guide cover those environments. Test the actual agent integration separately; it may operate through a different identity or tool set from the browser UI.

For MCP-based integrations, follow the protocol's authorization security considerations, including token audience handling. Connecting a tool through a standard protocol does not automatically authorize every action that tool exposes.

Build an access test matrix

Create two tenants and at least two roles in a controlled test environment. Test permitted requests, explicit cross-tenant requests, indirect requests through documents, permission changes, and repeated questions after a cache has been populated.

Verify denied operations at the service or database boundary. Do not grade success only by whether the final sentence avoided mentioning a restricted value; the model should not have received unauthorized data in the first place.

Add a scheduled report and an expired session to the test set. Check how ownership, delivery recipients, and revocation affect access. Keep enough evidence to investigate failures without turning the test logs into a new data leak.

For the surrounding architecture, see how to build an AI data agent. Labs4Change can help review the data and permission model before a wider rollout.