Separate read authority from mutation authority

Follow the human permission model

A support worker might read an order to answer a customer question but lack permission to change its delivery address. If an assistant uses a service account with broad write access, it must not silently grant that worker the account's full authority.

Derive the caller from the authenticated session and evaluate the requested operation against the target. Read permission, note creation, address changes and cancellation may each have different rules. A single "can access orders" check is often too coarse.

Document which rules come from the application and which are enforced by the downstream service. If the service only sees a shared identity, the application carries more responsibility for preserving user-level boundaries.

Limit what read tools return

Read-only does not mean consequence-free. A tool can expose unrelated personal or commercial information to the model and then to the user. Return the fields needed for the task, filtered by the caller's authority.

Avoid using a broad record lookup as a convenient discovery mechanism when the user only needs a delivery status. Narrow responses reduce both accidental disclosure and the chance that irrelevant data influences a later action.

Apply access checks to stored results and resumed runs too. A record retrieved yesterday may no longer be available to the same user today.

Make escalation explicit

If a task requires authority the caller lacks, route it through an approved escalation or reviewer workflow. Do not let the model select a more powerful identity or alternate tool as a workaround.

An approval should grant a defined action under the organisation's policy. It should not become a general switch that upgrades the entire conversation. Bind it to the target and payload, and verify the approver's authority for that particular change.

Keep service credentials outside prompts and tool-visible data. The executor should use the required identity internally and return only the permitted result.

Test combinations of rights

Use test accounts with read-only access, limited mutation access and no access to the target. Exercise direct tool calls as well as natural-language requests. Include a user who can change one order but not another.

Then remove a permission while a task is paused and resume it. Verify the execution-time rule is enforced. The review should establish that the assistant helps users exercise their existing authority through a convenient interface, rather than becoming an indirect route to the service account's broader privileges.