Access and identities for AI

In one paragraph

An AI assistant or agent needs its own identity, in the same way a person needs a login before they can access anything. That identity carries its own permissions, is checked every time it asks for something, and leaves a record of what it asked and when. Treating an AI system this way, rather than letting it borrow a shared or general purpose login, is where most of the practical security work around AI actually happens.

Why it matters

An AI system that can read documents or take actions is, from a security point of view, another user of your systems, and it needs to be governed like one. Giving it a named identity means its access can be scoped precisely to what it needs, watched for anything unusual, and switched off on its own without affecting anyone else. Without that, an AI system tends to inherit broad access simply because it was easier to set up, which is exactly the kind of gap that later causes trouble.

How it works

• Each AI system, assistant or agent, is given its own named identity, distinct from any person's login and from any other system's.
• That identity is granted only the access it needs to do its job, following the principle of least privilege rather than convenience.
• Permissions are checked at the moment a question is asked or an action is attempted, not assumed once and left in place.
• Every request the identity makes is logged, so there is a record of who, or what, asked for something and what it was given.
• Two widely referenced sources cover the common ways these systems are attacked: an industry list ranks the risks specific to AI applications, and a national cyber security authority has written specifically about why prompt injection, one of those risks, is hard to fully prevent and needs to be designed around rather than eliminated.

What it looks like in practice

An assistant needs access to a shared set of documents so it can answer questions about them. Rather than reusing an administrator's login, the assistant is set up with its own identity, permitted to read only the specific set of documents it needs and nothing else. When someone asks it a question, that identity's permissions are checked at that moment, and the request is logged. If the assistant is retired, its access is switched off on its own, without touching anyone else's.

How this connects to our work

Giving every automated workflow its own identity and access boundary is standard in how we build them, and it depends on the permission model set up as part of your company knowledge AI.