Access control for AI: roles, SSO and least privilege
Short answer
Treat AI like any other business system: connect it to your identity provider with single sign-on, assign rights per role, and give every user, automation and agent only what they need. One important difference from ordinary software: the AI must also respect the user’s permissions when retrieving documents, otherwise the chat becomes a back door to information someone has no access to.
Why AI needs its own attention
In an ordinary application, access control determines which screens and data someone sees. AI adds something: the model reads documents on the user’s behalf, and an agent takes actions on the user’s behalf. If that does not happen with the same rights, three problems arise:
- Bypassed permissions: through the AI, information surfaces from folders the user may not open. See AI on your own documents.
- Over-privileged agents: an automation runs under an admin account and can do more than its task requires. See AI agents under control.
- Stray accounts: employees sign in to AI services with personal accounts, outside your identity provider, and keep access after they leave.
How to set it up
- Single sign-on through your identity provider (for example Entra ID or another SAML or OIDC provider), so joiners and leavers are handled automatically.
- Groups as the basis for roles. Use the groups you already have, such as departments and job roles, and link them to which models, sources and automations are available.
- Pass permissions through at retrieval. An AI that searches documents filters on what this user may open in the source system.
- Separate identities for agents, with only the rights their task requires.
- Restrict admin rights. Those who manage policy, logs and models are a small, named team, preferably with two-person approval for sensitive changes.
- Logging per identity, so every action can be traced to a person or agent.
AI in a zero trust architecture
Zero trust starts from “never trust, always verify”: every access request is assessed on identity, device and context. For AI that means:
| Principle | Applied to AI |
|---|---|
| Verify explicitly | Every AI session through SSO, with MFA and device checks according to your policy |
| Least privilege | Per role, only the models, sources and automations that are needed |
| Assume breach | AI node in a segmented network zone, no unnecessary outbound connections, logs to the SIEM |
How werqly handles this
werqly connects the AI node to your identity provider. In werqly AI Control you use the groups from that identity provider to decide per role which model, which sources and which automations are available, and which data is held back. Sources are searched with the user’s permissions respected, and every action is in the audit log with identity and timestamp.
Because the node sits in your own network, it falls under your own network segmentation and monitoring, just like your other critical systems. See What is private AI? and Assessing an AI vendor.
Frequently asked questions
Questions on this topic
Should an AI environment be connected to our identity provider?
That is strongly recommended. With single sign-on, joiners and leavers are handled automatically, you can enforce MFA and device policy, and you base rights on groups you already manage.
How do I stop the AI from showing documents someone has no access to?
By respecting the user’s permissions from the source system when documents are retrieved. The AI then only searches what that person may open. Test this explicitly with an account that has no access to a sensitive folder.
Which rights does an AI agent get?
Only what its task requires, through its own identity, not through an employee’s account or an admin account. That way you can manage rights separately, trace actions and switch the agent off independently of others.
Who may administer the AI environment?
A small, named team. Have sensitive changes, such as viewing individual prompts or widening rights, approved by two people and recorded in the audit log.
Sources
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.