How to set permissions for an enterprise AI assistant
Setting permissions for an enterprise AI assistant means defining what each role may read and which actions it may propose, then placing people into those roles. The assistant inherits only the files that person can already open. People, legal text, amounts, and commitments to outsiders still wait until the responsible person has reviewed them.
On this page
Define roles before adding people
The permission table lists roles first, then people. Split roles by the work: someone who looks up a rule, someone who drafts a reply, someone who may approve sending the draft. One person may hold two roles. The two roles still list their reading scope separately.
When someone leaves, changes jobs, or a project ends, remove them from the role. There is no need to edit every file. Name roles after the job. Avoid names such as “everyone” or “management” that pull in more people than the work requires.
Give only the access the job needs
The NIST Computer Security Resource Center glossary defines least privilege as a security principle: a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks. That page places this wording under sources including CNSSI 4009-2022 and NIST SP 800-12 Rev. 1. Separate entries on the same page, from NIST SP 800-53 Rev. 5 and NIST SP 800-171r3, describe a security architecture in which each entity receives the minimum authorizations and resources it needs to perform its function.
For the assistant, that means opening only the kinds of files the role needs in order to answer. Each extra folder is another path that can end up in a reply. Start narrow and add a folder after it has been used. That is easier to check than opening the whole store and trying to take access back.
Inherit the file store’s existing access
When the assistant reads a file, it follows the access control that already applies to that person in the file store. A folder the person cannot open should not be summarised in the chat. Inheritance covers the parent folder’s current settings and any tighter setting on an individual file.
If the file store’s own grants are already too wide, tidy the store before connecting the assistant. The assistant will carry those wide grants into the answers. List which folders follow a department, which contracts or pay files need their own grant, and who may change those settings.
People, legal, money, and external commitments stay with a reviewer
Four kinds of material may be read by a role and still must not leave as an approved rule: people (pay, discipline, personal data), legal text (contract terms, disputes, compliance judgements), amounts (quotes, payments, the books), and commitments to outsiders (dates, warranty, wording that can be quoted outside). The assistant may draft. A person approves.
The reviewer sees the draft and the cited source before anything is sent. If the source does not match, or the source is marked draft or out of date, the reviewer sends it back for a person to rewrite. A confident sentence does not skip that review.
Keep a record of who asked what
A record that can be checked includes the account, the time, the role, the question, and the files the reply cited. Security and the business owner use it to see whether permissions and review followed the written rules.
The record is data too. Fewer people should be able to read the audit record than can use the assistant, and those people should be separate from the people who can change permissions. How long to keep it follows the company’s existing retention rules. This note does not set a number of days.
Give the assistant its own identity
If the assistant must reach a system other than the file store, give it its own identity and only the operations that process needs, such as reading one class of work order or creating a draft. Put that identity on the same role table, so it can be turned off when someone leaves or a project ends.
Do not let the assistant call other systems with an employee’s personal account. When that account is disabled, the connection drops. When that account’s permissions change, what the assistant can do changes with them, and it is hard to say later who authorised the call.
When the whole drive should stay closed
If the drive also holds pay files, unpublished contracts, customer personal data, or decisions not yet shared outside, do not grant it all at once so that every question has an answer. Separate the folders the assistant may use from the folders that stay in manual work.
How to split a knowledge base and how to mark sources is covered in How to build an enterprise knowledge base. The permission table should match that scope: a file the knowledge base did not take in is a file the assistant does not read.