ON THIS PAGE (6 SECTIONS)
- ✓Prompt instructions like "only show this to managers" provide zero security against linguistic jailbreaks and prompt injection.
- ✓Authorization must be enforced deterministically at the database query level using authenticated user identity claims.
- ✓Agents must never execute tools using master root credentials; each invocation must assume ephemeral least-privilege tokens.
- ✓Cross-tenant isolation requires database row-level security (RLS) or mandatory tenant predicate filters on all vector searches.
The most dangerous architectural vulnerability in enterprise AI deployments is confusing model comprehension with user authorization. An LLM may accurately understand that a specific payroll document is confidential, but if the system’s retrieval layer fetches that document and inserts it into the prompt context, the model can easily be coerced into summarizing or leaking that data through linguistic manipulation or indirect prompt injection.
In enterprise software, the rule is uncompromising: the model must never be the security boundary. Authorization, tenancy isolation, and role-based access control (RBAC) must be enforced deterministically by the underlying data store and API gateways before any bytes are forwarded to an AI model.
The Fatal Flaw of "System Prompt Authorization"
Early AI prototypes frequently attempt to enforce permissions by injecting instructions into the system prompt: *"You are an assistant. The user has role JUNIOR_ENGINEER. Do not share financial ledgers or executive compensation details."* This approach fails repeatedly against basic adversarial testing for three reasons:
- No Token-Level Separation: Large language models process system instructions and user inputs within the same semantic attention matrix. A clever prompt injection can reframe the task as an audit or hypothetical analysis, bypassing the instruction.
- Context Leaks via Tool Execution: If the model is granted access to a tool named `fetch_salary_data()`, an attacker can instruct the model to execute the tool for debugging purposes, capturing the output before any filtering occurs.
- Zero Audit Defensibility: Compliance standards (SOC2, ISO 27001, HIPAA) require cryptographic, deterministic proof that unauthorized users cannot read restricted database records. Prompts provide no audit evidence.
Deterministic Identity Propagation Architecture
Secure AI architecture relies on identity delegation: every AI operation executes in the security context of the authenticated human user, propagating identity tokens through every layer of the system stack.
| System Boundary | Security Mechanism | Enforcement Point | Failure Outcome if Bypassed |
| Client / User Gateway | OAuth 2.0 / JWT Claims Validation | API Gateway / Envoy | Unauthenticated request rejected with HTTP 401 |
| Vector Retrieval Layer | Pre-Filtering SQL / Metadata Predicates | Vector DB / PostgreSQL RLS | User only retrieves documents they have permissions to view |
| Model Context Assembly | Context Token Budget & Tenant Scoping | Orchestration Service | Zero unauthorized documents injected into model prompt |
| Tool & MCP Execution | Scoped Ephemeral Tokens (STS) | MCP Server / Database Gateway | Agent cannot execute mutations outside user privilege bounds |
Implementing Row-Level Security in Multi-Tenant Retrieval
When vector search is powered by PostgreSQL using `pgvector`, authorization should be enforced directly inside the database kernel using Row-Level Security (RLS). This ensures that even if an agent generates a malicious query, the database engine physically refuses to return rows belonging to another organization or restricted department:
| 1 | import { Pool } from 'pg'; |
| 2 | |
| 3 | export async function searchAuthorizedEmbeddings( |
| 4 | queryVector: number[], |
| 5 | userSession: { userId: string; tenantId: string; roleLevel: number }, |
| 6 | pool: Pool |
| 7 | ): Promise<any[]> { |
| 8 | const client = await pool.connect(); |
| 9 | try { |
| 10 | await client.query('BEGIN'); |
| 11 | |
| 12 | // Set transactional session variables matching user identity claims |
| 13 | await client.query('SELECT set_config($1, $2, true)', [ |
| 14 | 'app.current_tenant_id', |
| 15 | userSession.tenantId |
| 16 | ]); |
| 17 | await client.query('SELECT set_config($1, $2, true)', [ |
| 18 | 'app.current_user_role', |
| 19 | userSession.roleLevel.toString() |
| 20 | ]); |
| 21 | |
| 22 | // RLS policy automatically filters rows matching tenant_id and roleLevel |
| 23 | const query = ` |
| 24 | SELECT id, document_id, content, |
| 25 | 1 - (embedding <=> $1::vector) AS similarity |
| 26 | FROM document_embeddings |
| 27 | ORDER BY similarity DESC |
| 28 | LIMIT 5; |
| 29 | `; |
| 30 | |
| 31 | const { rows } = await client.query(query, [JSON.stringify(queryVector)]); |
| 32 | await client.query('COMMIT'); |
| 33 | return rows; |
| 34 | } catch (err) { |
| 35 | await client.query('ROLLBACK'); |
| 36 | throw err; |
| 37 | } finally { |
| 38 | client.release(); |
| 39 | } |
| 40 | } |
Ephemeral Credentials for Autonomous Tool Calls
When an AI agent is empowered to invoke tools—such as creating database tickets, sending emails, or executing code—it must never be configured with master service credentials. If an agent executes an operation on behalf of User A, it must acquire an ephemeral token limited strictly to User A’s role and expiring in under 15 minutes. If User A cannot delete records in production, the agent must be technically incapable of deleting records, regardless of prompt instructions.
The security boundary of an AI tool is the database credential attached to its execution handler, not the text description written in the tool prompt.
When ABAC Overcomplicates Simple Deployments
While complex Attribute-Based Access Control (ABAC) is essential for large enterprises with cross-department data sharing policies, imposing fine-grained dynamic attributes on small, single-tenant internal applications adds unnecessary architectural friction. For small teams, simple tenant isolation combined with basic role checks provides complete security without the latency overhead of dynamic policy evaluation engines.
For implementation guidance on isolating tool boundaries and defending against injection vectors, read our technical articles on Least-Privilege MCP in Production, Prompt Injection Defense, and AI Data Retention Policies.
References & Prior Art
NIST Special Publication 800-162: Guide to Attribute Based Access Control (ABAC)
Vincent C. Hu, David Ferraiolo, Rick Kuhn, et al. • National Institute of Standards and Technology (NIST) (2019)
RFC 8693: OAuth 2.0 Token Exchange for Delegated Identity
M. Jones, A. Nadalin, B. Campbell, et al. • Internet Engineering Task Force (IETF) (2020)
OWASP Top 10 for LLM: LLM06 Excessive Agency & Privilege Creep
OWASP GenAI Security Committee • OWASP Foundation (2025)
Panneer
Systems EngineerPanneer builds production AI data channels, Model Context Protocol (MCP) server boundaries, and evaluation harnesses with deterministic gates.
