Permission Models for Multi-Tenant AI Copilots

Chat access is not data access

Users who can open a copilot panel must not automatically read every document the model can retrieve. Separate conversation membership from resource entitlements. The model sees only what a server-side policy allows for that principal in that tenant—never what a prompt claims the user needs.

Cross-tenant leakage often starts in retrieval: embeddings indexed without tenant predicates, or shared vector collections queried by similarity alone. Put tenant id in every index partition and every tool argument validation.

Authorize tools like public APIs

Every tool invocation should pass through the same authz middleware as your REST or gRPC handlers: authenticate the user (or service identity), resolve tenant context, check RBAC/ABAC, then execute with least privilege. Agents must not hold long-lived god tokens that bypass row-level checks.

Prefer short-lived, scoped credentials issued per session or per tool call. When agents fan out, propagate subject and tenant claims—do not widen scope because a planner step 'needs more context.'

• Enforce tenant predicates on retrieval indexes and tool arguments
• Reuse API authz middleware for every tool call; no shadow permission path
• Issue short-lived scoped credentials instead of shared service gods
• Audit principal, tenant, tool, resource, and decision for each call

Model the principal the agent acts as

Decide whether the copilot acts as the end user, as a constrained assistant role, or as a break-glass operator with separate approval. Document the difference for support and compliance. Impersonation without audit is a security incident waiting to happen.

Prompt injection can try to elevate tools. Defense is policy enforcement outside the model: deny lists, allow lists of tools per role, and output filters that cannot grant new permissions.

Prove isolation continuously

Add automated tests that attempt cross-tenant retrieval and tool calls with stolen conversation ids. Monitor denial rates and unexpected allow spikes after prompt or index changes. Multi-tenant copilots fail loudly in demos and quietly in production—instrument for the quiet failures.

Permissions are product surface. Design them with the same care as the model that speaks behind them.

• OWASP — LLM Top 10
• OpenAI — Safety best practices
• Auth0 — Authorization patterns