Enterprise AI Agent Security: Why Backend Must Enforce Permissions, Not Prompts

Many teams initially assume that building an AI Agent only requires making it smart enough to query knowledge bases, call tools, and execute tasks automatically. However, once integrated into company systems, a crucial oversight emerges: permission and data isolation. The stronger the Agent's capabilities, the greater the business risk if these are mishandled.

01 · Identity: Authentication Is the Foundation

After a user logs into the Agent system, the backend typically obtains user identity via JWT, OAuth2, or SSO — capturing userId, tenantId, departmentId, and role. A common mistake by less experienced engineers is stuffing all permission information into the Prompt and instructing the LLM: "Current user is a regular employee, only allowed to view their own data." This is merely a reminder, not permission control. Prompts constrain LLM behavior; the true security boundary must reside in backend code. As the article states: "Prompt can remind the LLM not to cross boundaries, but the backend must ensure it cannot cross even if it wants to."

02 · Data Isolation: Filter at Query Time, Not After

Consider a SaaS platform serving 100 companies. An employee from Company A asks: "Find refund orders over 10,000 yuan in the last month." The naive implementation queries all matching data first, then asks the LLM to filter for Company A. This is wrong. TenantId, departmentId, and similar conditions must be pushed directly into the database WHERE clause or Elasticsearch Filter. The Agent should receive only pre-filtered data — never all data followed by LLM-based filtering.

03 · RAG Security: Metadata Filtering During Retrieval

Early RAG projects focus only on retrieving relevant documents. In enterprise settings, a second question is mandatory: "Does this user have permission to see this document?" When writing documents to the knowledge base, besides content, title, and vector, permission metadata (tenantId, departmentId, role, documentLevel) must be stored. During retrieval, filters are dynamically generated from the current user's identity. Unauthorized documents never enter the recall results, let alone the Prompt. Key principle: "Data permissions are best solved at 'retrieval time,' not 'before LLM answers.'"

04 · Tool Control: Backend Decides Execution, LLM Decides Intent

If an Agent only answers questions, the worst outcome is a wrong answer. Once it calls Tools, consequences can be severe. The solution: classify Tools by risk level and enforce role-based permissions. Before execution, the backend must verify: user has Tool permission, data belongs to the tenant, parameters are valid, amount limits are not exceeded, and approval is obtained if required. Core principle: "LLM decides 'what to call,' backend decides 'whether it can be called' — each does its job."

05 · Memory: Isolation Beyond Conversation ID

Agents often store history, preferences, task state, and long-term memory in Redis, MySQL, or vector databases. If memory is managed only by conversationId without userId, tenantId, or other isolation dimensions, dangerous data leakage occurs. Enterprises may need personal, department-level, and enterprise-level memory separation. In enterprise Agents, memory itself is a category of data requiring permission protection.

06 · Audit: Complete Logs for Traceability

Enterprise systems require business traceability when issues arise. Agents must leave complete audit records for key operations: who triggered it, what data was accessed, what actions were taken, why it was allowed, and whether the trail can be reconstructed after privilege escalation, misoperation, or data leakage.

Summary

Personal demos ask: "Can the Agent get the job done?" Enterprise Agents ask: "Who authorized it? What did it see? What did it do? Why was it allowed? Can we trace it if something goes wrong?" Enterprise-grade permission and data isolation is far more than a simple RBAC implementation. Final rule: "Agents can get smarter, but permissions must never be left to the Agent to decide."