AI Executive Office — CXO Assistant Platform (On-Premises) · View 27 of 30 · 7 · Assurance
The rule
- The AI inherits the user's authorisation context and never exceeds it. If the CXO cannot see a figure in the source system, no agent, index or cache can surface it to them here
- RFC 8693 token exchange carries the user into every downstream read. Row-level security in the semantic layer and group filters in the search index are both evaluated as the caller
- The alternative — a privileged service identity that reads everything, with the application filtering afterwards — is rejected. It makes every application bug a data breach
- The MCP server is a policy enforcement point, not a credential holder. The caller’s exchanged token is passed through to the source, so an MCP server holds nothing worth stealing
What this costs
- Per-caller queries cache poorly. The mitigation is a permission-fingerprint cache key rather than abandoning the model (view 15)
- Scheduled work — the detection sweep, the morning brief — has no user to act as. It runs under a constrained identity against pre-authorised aggregates only, and anything it surfaces is re-checked against the reader's own permissions before display
Assumptions
- Source systems can express permissions the platform can evaluate. Where a legacy system cannot, that source is limited to aggregate measures with no drill-down, and the limitation is stated to the tenant
