Enterprise AI Agents: Why Permissions & Data Isolation Must Be Enforced in Backend, Not Prompts

01 · Identity: Authentication Is the Foundation

Permission control starts with identity authentication. After a user logs into the Agent system, the backend typically obtains current user information—such as userId, tenantId, departmentId, and role —via JWT, OAuth2, or SSO.

A common mistake by less experienced engineers is stuffing all permission information into the Prompt and telling the LLM: "Current user is a regular employee, only allowed to view their own data." This is merely a reminder, not permission control. The real security boundary must be held in backend code. As the article states: "Prompt can remind the LLM not to cross boundaries, but the backend must guarantee it cannot cross even if it wants to."

02 · Data Isolation: Filter at Query Time, Not After Retrieval

Consider a SaaS platform serving 100 companies . An employee from Company A asks: "Find refund orders over 10,000 yuan in the last month." The Agent may call an order tool or query MySQL/Elasticsearch. The naive implementation fetches all matching data first, then asks the LLM to filter for Company A's data.

Correct approach: push tenantId, departmentId, and similar conditions directly into the database WHERE clause or Elasticsearch Filter. The Agent should receive pre-filtered data —never all data followed by LLM-side filtering.

03 · RAG Security: Knowledge Base Also Leaks Data

Many RAG projects initially focus only on retrieving relevant documents. In enterprise settings, you must also ask: "Does this user have permission to see this document?"

When writing documents to the knowledge base, besides content, title, and vector, you must store permission metadata —e.g., tenantId, departmentId, role, documentLevel. During retrieval, dynamically generate filters based on the current user's identity. Unauthorized documents never enter the recall results, let alone the Prompt. Data permissions should be resolved at 'recall time,' not 'before LLM answers.'"

04 · Tool Control: Tool Permissions Are More Dangerous Than Query Permissions

If an Agent only answers questions, the worst case is a wrong answer. Once it calls a Tool, a mistake can be severe. The recommended approach: classify system tools by risk level and enforce role-based permissions .

At minimum, the backend must verify:

Does the current user have permission for this Tool?

Does the current data belong to this tenant?

Are parameters valid?

Does the amount exceed limits?

Is approval required?

Core principle: "The LLM decides 'what to call'; the backend decides 'whether it can be called.' Each does its job."

05 · Memory: Agent Memory Must Also Be Isolated

An often overlooked area is Memory. Many Agents store conversation history, user preferences, task state, and long-term memory in Redis, MySQL, or vector databases. If memory is managed only by conversationId without userId, tenantId, and other isolation dimensions , dangerous data leakage can occur.

Enterprises may also need department-shared or team memory, requiring further distinction between personal, department, and enterprise-level memory . In enterprise Agents, memory itself is a category of data requiring permission protection.

06 · Audit: Always Keep Audit Logs

Enterprise systems require business traceability. When the Agent executes critical operations, it must leave complete audit records . This enables reconstruction of the entire execution flow if privilege escalation, misoperation, or data leakage occurs.

Summary

Personal demos ask: "Can the Agent get the task done?" Enterprise Agents must answer: "Who asked it? What did it see? What did it do? Why was it allowed? Can we trace it if something goes wrong?"

Therefore, enterprise Agent permission and data isolation is absolutely not just a simple RBAC implementation —it is far more complex, spanning identity, query filtering, RAG metadata, tool risk control, memory isolation, and audit logging.

Final rule: The Agent can become smarter, but permissions must never be left to the Agent itself to decide.