AI Executive Office — CXO Assistant Platform · View 27 of 30 · 7 · Assurance
The rule
- The AI inherits the user's authorisation context and never exceeds it. If the CXO cannot see a figure in the source system, no agent, index or cache can surface it to them here
- On-behalf-of token exchange carries the user into every downstream read. Row-level security in the semantic model and group filters in the search index are both evaluated as the caller
- The alternative — a privileged service identity that reads everything, with the application filtering afterwards — is rejected. It makes every application bug a data breach
What this costs
- Per-caller queries cache poorly. The mitigation is a permission-fingerprint cache key rather than abandoning the model (view 15)
- Scheduled work — the detection sweep, the morning brief — has no user to act as. It runs under a constrained identity against pre-authorised aggregates only, and anything it surfaces is re-checked against the reader's own permissions before display
Assumptions
- Source systems can express permissions the platform can evaluate. Where a legacy system cannot, that source is limited to aggregate measures with no drill-down, and the limitation is stated to the tenant
