Customer 360 Enterprise Data Platform — Denodo on Azure  ·  View 24 of 39  ·  Runtime

The AI Assistant

How a grounded answer is produced, and why the model needed no security design of its own.

Editable source SVG draw.io All views
Service Agent Assistant UI Microsoft Entra ID Azure OpenAI Denodo MCP Server VDP Data Services Sources and Lakehouse Audit Log 1. Why is this invoice unpaid? 2. on-behalf-of token for this agent 3. delegated token, agent scopes 4. prompt and tool schema 5. call get_customer_summary 6. query as the agent, not as a service 7. row filter and masks applied 8. delegated reads 9. rows 10. masked rows with lineage refs 11. tool result and citations 12. call get_full_card_number 13. denied, not in the agent's grants 14. answer grounded on what was returned 15. answer with named sources 16. prompt, tools called, rows returned Runtime — The AI Assistant Inherits the Agent's Entitlements The model has no credential of its own. Step 13 is refused by the same policy that would refuse the agent in Power BI, which is why the assistant needed no security design of its own. v 1.0 · owner Data & AI Global Practice · date 2026-09

The decision that makes this safe

  • The assistant carries the agent's on-behalf-of token and queries as the agent. It holds no credential and has no entitlements of its own — the row filters and masks that apply in Power BI apply here unchanged.
  • Step 13 on the diagram is the point: a request for an unmasked card number is refused by the same policy that would refuse the same agent in any other channel. No AI-specific guardrail was needed, because there was no AI-specific access path to guard.
  • Tool results carry lineage references, so an answer can be traced to the views and sources it was grounded on.

The alternative rejected

  • A service principal for the assistant with broad read access and prompt-level filtering. It works in a demonstration and fails the first time a prompt is phrased in a way the filter did not anticipate.
  • Grounding on a vector index built from the 360 was also rejected for the operational use case: the index is a copy, and a copy of entitled data has its own entitlement problem.

Risks

  • Prompt and response are logged with the rows returned. That log is itself sensitive and lands in Sentinel under the same retention and access rules as the audit trail.
◀  Real-Time Digital Activity All views When a Source Goes Down  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 39 views · Denodo Platform, Microsoft Azure and open source24-ai-assistant-flow