Access Control for AI Platforms
How identity, permissions and policy should govern users, agents, knowledge and tools at every request.
AI access control is more than deciding who can open a chat. The platform must enforce what each identity can retrieve, which models it may use, which tools it can call and what actions require approval.
Enterprise assistants often span multiple repositories and systems. Without dynamic authorisation, AI can accidentally combine information that users could never access through the original applications.
Apply permissions when the request is executed, not only when content is indexed or a workspace is created.
There is rarely one universally correct architecture. The best decision is the one that fits the process, risk, people and operating capability of the organisation.
Why it matters
Enterprise assistants often span multiple repositories and systems. Without dynamic authorisation, AI can accidentally combine information that users could never access through the original applications.
In practice, value appears when the technology becomes part of a governed process: responsibilities are clear, evidence can be checked and the organisation can observe whether outcomes improve.
What it really means
AI access control is more than deciding who can open a chat. The platform must enforce what each identity can retrieve, which models it may use, which tools it can call and what actions require approval.
The useful distinction is between a technical capability and a production service. Enterprise use requires identity, permissions, data handling, evaluation, monitoring and a clear owner for the result.
How it works in practice
The flow can be described in five steps. Each one needs an explicit purpose, an owner and a way to verify that it behaves as expected.
The exact architecture will vary. What matters is keeping the boundaries visible and making failures diagnosable rather than hiding them behind a fluent answer.
What this looks like in real work
A regional manager can query sales reports for their region. The same assistant, used by a board member, can access consolidated results because retrieval inherits current corporate permissions.
The lesson is not that AI produced an answer. It is that the answer appears inside a controlled process, can be verified and is tied to a measurable outcome.
Common mistakes we see
Copying documents into open workspaces
The workspace can bypass the original repository’s access model.
Using one service account for everyone
Attribution and least privilege disappear.
Checking permissions only in the interface
Backend retrieval and tools must enforce the same decision.
Ignoring permission changes
Access needs to reflect revocation and role changes quickly.
When it makes sense
- The process has a clear owner and outcome
- The required information and permissions are understood
- Results can be checked or measured
- The organisation can operate the capability responsibly
When it probably does not
- The problem is still undefined
- A deterministic rule would be simpler and safer
- No one owns data quality or exceptions
- The consequence of failure cannot be controlled
Not using AI can be the right decision. Honest scope is usually more valuable than a technically impressive pilot without a real problem.
How we usually approach it
We work from engineering and operational experience. We do not believe in a universal recipe, but we consistently ask the same questions before building:
Once these answers are reasonably clear, choosing models, infrastructure and integration becomes much easier.
Useful enterprise AI is not defined by how impressive the demo looks, but by how reliably it improves a real process.
Technology evolves quickly and we do not claim to have final answers. These guides capture what we have learned while building and operating platforms, shared with the humility that tomorrow may require a better approach.