Back office ops · Production
Permissions for AI Use Cases: How to Handle Identity and Permissions with AI
The problem
AI applications operating on content collections (documents, videos, etc.) cannot reuse traditional table-level warehouse permissions because the content contains PII and sensitive data; individual user roles must be preserved per-request, and relying on the AI itself to restrict sensitive information has been shown to be a flawed approach.
Workflow diagram · grounded in source
1
Extract permissions with content
integration
“we can produce 2 streams of data:
Files: The documents themselves in textual (e.g. markdown) format we need for our AI applications, and related metadata. Included in this metadata are the IDs of users and groups who have access to it
I…”
2
Filter into role-specific collections
routing
“you may wish to use filters as a coarse way of adding role information to the dataset”
3
Map identities to content streams
integration
“joining (in the SQL-sense) all the user and role information to the original content record so that we have an easy way to query who can access each item. This will be duplicative of the data (adding storage cost) with the goal of produc…”
4
Identity-scoped AI query
ai_action
“you will choose to hit the RAG/Chat completion/Search/Aggregation APIs including a user's email address or not. If an email address is provided, all the information provided back to you & the LLM will be further filtered to what they are…”
Reported outcome
(not stated)
Reported stack
Google DriveRAGLLM
Frequently asked questions
What did this team achieve with this AI workflow?
(not stated)
What tools did this team use?
Google Drive, RAG, LLM.
How is this back office ops AI workflow structured?
Extract permissions with content → Filter into role-specific collections → Map identities to content streams → Identity-scoped AI query.