An AI assistant is software that interprets information, synthesizes content, analyzes artifacts, or recommends actions. In authorization-sensitive workflows, it should assist people and systems without deciding access. section 17.0
Authorization decisions require deterministic, explainable, auditable, and reproducible outcomes. An assistant may infer intent fluently, but identical requests can produce different answers, making it unsuitable as the policy engine. section 17.1
Use an AI assistant around the enforcement path rather than in place of it:
- Draft candidate policies, clarify policy logic in plain language, and identify overlooked edge cases during design-time work. section 17.2
- Compare design-time intent with observed runtime behavior through analysis, while leaving final evaluation to the policy engine. section 17.0
- Construct an authorized context before prompting, so the model receives only approved data and permitted actions. section 17.0
A support chatbot with embedded access rules
A prototype placed access rules in its prompt and asked the assistant whether to display internal documents. The same request and context could receive both permit and deny decisions, each with a plausible explanation; a policy engine must instead evaluate the request consistently. section 17.1
Figure 17.1 Nondeterministic AI authorization. When authorization intent is embedded in prompts and inferred by an AI system, identical requests with the same context can result in different outcomes. In this example, the same access request and prompt lead to both permit and deny decisions, each with a plausible explanation. Since the reasoning is inferred rather than evaluated as policy, the results are not repeatable and cannot be used as a reliable basis for access enforcement.
The figure makes the enforcement risk concrete by contrasting identical requests that produce inconsistent AI-generated authorization outcomes. section 17.1
Figure 17.2 Authorized context for AI prompts. ACME performs authorization before prompt construction, producing an authorized context that defines which data and actions are permitted for the current request. The AI model may receive sensitive data, but only data approved by the authorization layer. The model does not query sensitive data directly or decide what it is allowed to access.
The figure shows the safer boundary: authorize data and actions before constructing the prompt, then give the assistant only the resulting context. section 17.0
