AI Access Control: Scoping What Agents Can Read and Do

An AI assistant that can read the whole document store and an agent that can call any API are not powerful; they are breaches waiting for a prompt. Access control for AI starts from a simple rule: the system may read and do only what the person or process it acts for is permitted to, and that rule is enforced outside the model, because the model can be talked into anything. This guide covers identity, delegated permissions, retrieval trimming, tool scoping, secrets, and audit, drawing on FISTA Solutions' AI agents practice. The architecture is in ai and zero trust architecture and the full security design in the AI agent security architecture whitepaper.

What are the layers of AI access control?

Layer	Control	Enforced where
Identity	Every request carries the principal the agent acts for	Gateway; application
Delegation	Agent operates with the principal's permissions, not a broad service account	Identity provider; tokens
Retrieval trimming	Only permitted documents reach the model's context	Retrieval layer, before the model
Tool scoping	Least privilege per tool, per agent, per action	Tool layer
Gates	Consequential actions require approval tokens	Tool layer
Secrets	Credentials in vaults; never in prompts, context, or logs	Secrets management
Audit	Every read, action, gate, and denial logged with identity	Observability

Why is the model not a security boundary?

Because it follows instructions found in its context, including content an attacker planted, and because it cannot reliably distinguish what it should withhold from what it should share. Instructions such as "do not reveal restricted documents" fail under injection. Access control therefore lives in the systems around the model: what reaches its context and what its tools will execute. Attack patterns are in ai agent security risks.

How should identity and delegation work?

Every request carries the identity of the user or process the agent acts for, established through the organization's identity provider; the agent's retrieval and tool calls execute under permissions delegated from that identity through short-lived, scoped tokens. Background agents that act without a user get their own identities with permissions scoped to their role. Broad service accounts that let an agent see everything are the most common design failure. Platform-specific delegation is in how to build a salesforce ai agent.

How does permission-trimmed retrieval work?

Permission metadata is synced from source systems with each document or chunk, verified at query time against the caller's current rights, and applied as a hard filter before results are ranked and before any content reaches the model. Sync frequency is set so revoked access takes effect within an acceptable window, and every result served is logged with the permission check that allowed it. Retrieval mechanics are in what is hybrid search and a worked build in how to build ai search for sharepoint.

How should tools be scoped and gated?

Each tool exposes the minimum capability the agent's role requires, with strict input validation, the caller's permissions enforced on every call, and structured errors. Read and write tools are separated. Write tools that create consequences require approval tokens tied to a specific request, issued through a gate that presents evidence to an authorized approver. Tool design is in how to build tool use for llm agents and gate design in what is a human approval gate.

How should secrets be handled?

Credentials live in a secrets manager and are injected into tool execution at runtime, never placed in prompts, context, or logs. Model provider keys are held by the gateway, not by applications. Prompts and outputs are scanned for secret patterns before logging. An agent that can read a secret from its context can be made to reveal it. Practice is in ai secrets management.

What should be logged and how?

Every retrieval with identity and the permission check that allowed it; every tool call with validated inputs and results; every gate decision with approver and time; and every denial. Sensitive content is redacted, retention follows policy, and the audit trail itself is access-controlled, because a log of everything the assistant retrieved is a high-value target. Audit design is in how to build an ai audit trail.

What mistakes cause leaks?

Broad service accounts for agents; retrieval filtered by the model rather than before it; permission metadata synced too rarely; tools that trust model-supplied identifiers without checking the caller's rights; secrets in system prompts; logs that contain what retrieval returned without redaction; and gates the agent can bypass by calling the underlying API. Each is a known pattern with a known fix. Leakage controls are in ai data leakage prevention.

What does sound AI access control look like in practice?

An enterprise knowledge assistant authenticates each user through the identity provider, retrieves only documents whose synced permissions match the user, verified at query time, and passes them to the model. Its tools for creating tickets and updating records run under the user's delegated token, validate inputs, and route record updates above a threshold to an approval gate. Provider keys sit in the gateway, secrets in a vault, and every retrieval and action is logged with identity and redacted content. A quarterly review samples the log against permissions. Enterprise assistant patterns are in how to build an ai hr assistant.

How FISTA Solutions implements AI access control

FISTA Solutions designs every assistant and agent with identity per request, delegated permissions, retrieval trimmed before the model, least-privilege gated tools, vaulted secrets, and redacted audit logs, and tests permission boundaries with adversarial cases before launch. The AI agents practice delivers the systems, AI enablement provides the gateway and observability platform, and forward deployed engineers embed with client security teams. The record behind the approach is 150+ projects with 99.9% uptime.

To make sure your AI systems cannot read or do more than their users may, message FISTA on WhatsApp, or read ai and zero trust architecture for the architecture these controls sit within.