Permissions and data security in enterprise AI: what to ask before you choose

Permissions and data security in enterprise AI is the whole set of questions about which data the assistant reaches and by what path, what it can change, and who can see what. On a manager’s screen a question looks easy; but that question may open up the budget, sales by customer or shipment records. That is why, when choosing an AI assistant, you need to look at what is running behind it before you look at how fluent the answer is. However plain the chat interface, underneath it there is a layer that connects to the database, an account and a permission model; the risk lies in that layer, not in the interface.

The list below gathers questions you can put to any vendor. Under each heading we write separately what we can say today, and what we cannot say, about Fero, the YazSis Enterprise AI assistant.

Two approaches: ad hoc queries and defined tools

• Ad hoc queries: The model writes and runs queries against the database directly, according to the question. It is flexible; but it becomes hard to check which query ran and which tables were joined, and to catch a wrong figure. A wrongly joined table can produce a result that looks reasonable but is wrong.
• Defined business tools: The model calls only tools that have been defined in advance; what each tool does, what it reads and how it calculates is known. It is less flexible, but it can be audited. The range of questions that can be asked is also limited to the range of the tools; this should be read not as a shortcoming but as the price paid for control.

Fero uses the second approach. The AI does not write SQL; data is reached only through defined business tools, and no ad hoc query is run. The questions below look for the concrete counterparts of this approach.

Seven questions to ask the vendor

Access: by what path is the data reached, and can it change the data?

The first two questions are linked. In Fero, data is reached only through 17 defined, read-only business tools, and the application connects to the database only with an account that has read permission. The assistant therefore cannot change the data. Do not settle for the vendor’s description of this limit: check the permissions of the database account used for the connection together with your own IT team. An account that has only read permission means not that the system “tries to change and fails”, but that no path for changing exists in the first place; for security the difference is large.

Accuracy: who produces the figures and the screen?

The third and fourth questions concern the reliability of the number the manager sees. In Fero, KPIs, percentages and differences are calculated in the back end; the model cannot state a number that is not in the tool result. The screens are built only from 13 approved dashboard components, and the AI does not generate code. Ask the vendor to show which tool and which calculation a figure came from. If the source of a number to be used in a management meeting cannot be explained, the answer is not sufficient for a decision, however convincing it sounds.

Scope: who sees what, and where does the data go?

For the fifth and sixth questions we give no blanket assurance in this article, because the answers are specific to the project. Which data reaches whom, by user and role, should be asked about in the demo and in the project meeting with concrete examples. What information goes to the language model the assistant uses, where it is processed and whether it is stored is likewise something to be clarified in writing. We make no absolute claim such as the data never leaving the company; put this question to every vendor in writing, us included. A practical test of permissions is also possible: suppose a senior executive and a department head ask the same question, and ask to see on screen, not in words, which data reaches each of them. If the answer is not clear, suggest adding the permission model to the project plan as a separate work item.

Source: which data sources are really ready?

The seventh question separates the list of connections in the presentation from today’s situation. The data source that is ready in Fero today is MySQL; sources such as SQL Server, PostgreSQL, REST API, Logo, SAP, Odoo and Excel are handled within a project. Every new source also brings its own access account and its own permission review; put this in the project plan from the start. The difference between “ready” and “within a project” concerns both the schedule and the budget; getting this distinction from the vendor in writing reveals the real state of the connection list in the presentation.

Three scenarios to try in the demo

• A request to change data: Ask the assistant to delete or update a record. In a system that works read-only this should not be possible; also notice how the answer is given.
• An out-of-scope question: Ask a question that the defined tools do not cover and see how the system behaves. A good system states its limit openly instead of producing a made-up figure.
• A figure check: Have it look up a figure you know and compare it with your own report. If it comes out different, ask for an explanation of which tool and which calculation the difference comes from.

A security feature is not the one described in the presentation, but the one that can be tested in the demo.

You can look at how Fero works and what it can do today on the Enterprise AI page, and ask your questions in a live demo.