Permission

Permissions are the limits software enforces on what an AI can read, change or do. They can also require a person to approve an action before it happens. The product and the systems it connects to enforce these limits; asking the AI to follow a house rule is a different kind of control.

Paul and Linda Carter have separate advisers after their divorce. At Linda's request, an administrator restricts her back-office record to her adviser. Later, a trainee asks the firm's AI product to draft Paul a letter about his pension after the pension sharing order. The draft mentions Linda's new income. The trainee cannot open Linda's record to check it. The product's log shows that it retrieved that information from her record.

The principal connected the product to the back office using a login that opens every record. The product reused that connection for the trainee's request, so the trainee's own restriction did not apply. A firm can restrict a person's login and still expose more records through a shared AI connection. The firm needs to check which login the product uses and whether it checks the access of the person asking.