Define the permitted action
An agent that can call a tool needs a narrower permission than “help the user.” State what information it can read, which operations it can request, and when a person must decide. The question is about the application’s authority model as well as the model’s behavior. A prompt can describe a boundary, but the application must enforce it.
Carry identity to the data boundary
The tenant-isolation project describes production work on scoped queries and validation. For agentive BI, read-only SQL and execution limits constrain the work an agent can request. The public PostgreSQL documentation shows how row policies can restrict access and identifies important exceptions. A generic database feature does not prove that every surrounding application path respects the same boundary.
Minimize information and work
Give tools only the inputs required for the authorized task, validate requests before execution, and bound repeated calls. PII masking can reduce selected personal information passed downstream, while leaving residual identification risks. It serves a different purpose from authorization. Review error messages, stored results, and logs as possible data paths when designing controls.
Test attempts that should fail
General permission tests should cover wrong-tenant requests, stale identities, disallowed operations, and attempts to expand scope through retrieved text. Verify both the returned answer and the actions taken. These are recommended checks rather than an independent security assessment of the delivered work. Isolation controls reduce particular risks; they do not justify an absolute claim of security.
Sources & further reading
Written by Gilles Jacobs.
