AI agents need permissions, not trust

An AI assistant is only trustworthy if it runs under the asking user's permissions. AxisIQ checks every Ask Axis tool call and relays refusals.

An AI assistant that can act on your business data is only as safe as the permission system it answers to. AxisIQ is a business operations platform whose assistant, Ask Axis, holds no access of its own: every tool call it makes — looking up a record, creating or updating one, running a read-only analytics query, invoking one of your functions — is authorised against what the person asking is allowed to do. This piece is about why that distinction matters more than any system prompt, how Ask Axis is built around it, and five questions worth asking any vendor who has just shipped an AI feature.

A system prompt is a wish. A permission is a wall. Both look like control from the outside. Only one of them is still standing when the model is handed text that argues with it.

What goes wrong when an AI agent has its own account?

The common shape today is an agent wired to an integration account that can read everything and write most things. The limits are written in the prompt: only discuss the current user's own orders, never reveal cost prices, never touch anything outside this customer. In a demo this behaves perfectly, because in a demo nobody is trying.

Then the agent reads something it did not write. A supplier's PDF. A customer's support message. A web page it was asked to summarise. Somewhere in that text are instructions addressed to the model, and the model has no reliable way to tell your rules from the attacker's — both arrive as words, in the same channel, with the same authority.

What follows is not a bad answer. It is the integration account's full reach, aimed by somebody else. The failure is architectural: the only thing between untrusted input and the whole dataset was more text.

What "runs as the person asking" actually means

The alternative is unglamorous. Give the assistant no standing access at all, and turn each thing it wants to do into a request weighed against what the human asking is allowed to do. In AxisIQ that produces five concrete properties, and each is worth stating plainly because vague versions of them are easy to sell.

Checks happen per call, not per session. There is no point at which the assistant is issued a conversation's worth of access and then trusted with it. Each message resolves the asking person's current permissions, and every tool call made while answering it is judged against those — so narrowing someone's access takes effect on their next message, not at their next login.

Masked fields never reach the model. When a field is hidden from you, the assistant is not handed it and asked to be discreet. The masking happens where the data is read: denied fields are stripped out of record reads and come back as NULL in analytics queries, so the text the model works from never contained them. Redaction after the fact fails the moment the model is talked into quoting itself. It cannot leak what it never saw.

A refusal is relayed, not absorbed. A call outside your grants comes back into the conversation marked as an error, and the model has to pass that on: the step did not happen. An agent that rewrites a failure into a confident summary is worse than one that can do nothing at all, because you will act on the summary.

Writes are attributed. Anything the assistant changes lands in the same append-only trail as a change made by hand, recording who it acted for, which record moved, and the field values before and after. "The AI did it" stops being an explanation and becomes a lookup.

Spend is visible. Every turn's token usage and cost is recorded and rolls up for the organisation, so the question "what is this costing us" has an answer that is not a monthly invoice.

Read together, those five turn the assistant from a new kind of account into a new way of using an existing one. The most it can ever do is what you could have done yourself, more quickly.

The honest part: this constrains the assistant

It refuses things, and it will refuse things you wanted. Ask for a margin breakdown without permission to see cost prices and you get an answer with holes in it rather than the numbers. That is the design behaving correctly, and it is a worse demo than the alternative. We would rather have the worse demo.

There is a second limit, and pretending otherwise would be dishonest. Permissions bound escalation. They do not fix judgment. If you are allowed to delete a customer's records, an assistant acting for you is allowed to delete them too — a careless instruction, or a poisoned document that persuades the model mid-task, still operates inside your own rights. Running as you caps the blast radius at exactly your access, and leaves a trail of what happened. It does not make your access smaller than you made it. AxisIQ narrows the gap for the riskiest actions — money, outbound messages, invites and destructive changes stop and ask "go ahead?" first, and the approval covers exactly that one action — but a confirmation is only as good as the person reading it.

A third, for the same reason: the organisation's owner is exempt from field masking by design, so an assistant answering the owner has the owner's reach. Owner is not a high permission level, it is the absence of one — which is an argument for giving day-to-day work to people in narrower roles.

Which is the real argument for taking permissions seriously in the first place. Broad grants were survivable when every action needed a human to click it. Once a model can chain actions from one sentence, the size of the grant is the size of the accident — which makes narrowing your groups the first piece of AI safety work most teams should actually do.

Five questions to ask any vendor shipping an AI feature

None of these need a security team to evaluate. They need a straight answer.

1. Whose permissions does the agent run under? "The user's" should come back immediately. If the answer is a paragraph about safety layers, the answer is a service account.
2. Can it read fields the asking user cannot? Ask specifically whether restricted data is fetched and filtered afterwards, or removed where the data is read.
3. What happens when an action is denied? Does the person see the refusal, or does the model narrate around it?
4. Are the agent's actions in the audit log, attributed, with before and after values? A log that records "assistant activity" without naming the human behind it answers nothing during an incident.
5. Can an admin see what it has cost, over time? Consumption you cannot observe is consumption you cannot govern.

A vendor confident in their design will enjoy these questions. That reaction is itself the signal.

Chat is not the risky surface

The assistant is the visible AI in most products, so it gets the scrutiny. The dangerous paths are usually quieter: background automations, functions reachable at a public URL, API keys sitting in a partner's integration. If those routes bypass the checks the chat window respects, the chat window's guarantees are decorative — an attacker will simply use the other door.

In AxisIQ every path is evaluated the same way. A workflow inherits the grants of whoever built it, so its ceiling is that author's ceiling — no more, even when it fires at 3am with nobody watching. An integration authenticates as a service account that joins groups exactly like a person, is bound by the same rules, can never be the owner, and works only against the workspace its key belongs to. Public endpoints run as an anonymous identity that holds only what you deliberately granted it — grant nothing, and a public URL returns nothing.

That is the whole argument. An assistant is trustworthy to the extent that it is boxed in by the same machinery as everyone else, and the box is one you can inspect, simulate and narrow. You can see how this plays out in Ask Axis, and the reasoning behind the platform in why we built AxisIQ.

FAQ

Is it safe to give an AI assistant access to company data? It is safe to the degree that the assistant holds no access of its own. Check whether each action it takes is authorised against the person asking, at the time it is taken, rather than against a shared integration account with broad rights.

What permissions should an AI agent have? Ideally none in its own name. The workable model is that the agent inherits the asking person's grants for the duration of a request, so its ceiling is always a human's ceiling and can be lowered by editing that human's groups.

Can prompt injection make an AI assistant leak data it should not? It can only reach data the assistant was given. If restricted fields are stripped before any result becomes text, injected instructions have nothing to extract; if the data is retrieved and merely hidden behind an instruction, it is one convincing paragraph away from exposure.

How do I audit what an AI agent did? Look for agent writes in the same append-only record trail as human edits, attributed to the person on whose behalf it acted, with the previous and new values. In AxisIQ that is the Activity history on the record itself.

Does running under user permissions make the assistant less useful? It makes it refuse work the person could not do manually, which is the intended trade. In practice the fix is to review what that person is granted, not to loosen the assistant.