Learn AI /AI Security /Access control
Access control
- Starter
- AI Security
- Technical readers
Also called: permissions, least privilege.
Back to the milestone you came from
In five seconds
What it is
Access control sets rules about which people, systems or AI tools can view, use or change specific data, functions and resources.
In plain words
Access control means setting clear rules so a person or AI tool can only reach the information and functions needed for its job, and nothing more.
An everyday example
A neighbour is given a temporary code to water the plants while someone is away. The code opens the front door during agreed hours, but it does not open the locked desk drawer or let the neighbour change the alarm settings. Knowing that those things exist does not grant access. The code limits the person, place, action and time.
Real digital systems are more detailed than door access in a library. Permissions can apply not only to places, but also to actions like read, edit, delete, export or call an external tool. Also, software may act automatically on behalf of a user or service, so there may be several layers of checks, not one librarian at one door.
Remember thisAccess control checks who or what is asking, which resource is involved and which action is requested. An AI assistant should receive only the permissions needed for the task.
Understand it
Understand it
Why it matters
For non-specialists, access control is a clear way to reduce harm without understanding every technical detail of AI. If an AI assistant can only read a narrow set of approved documents and cannot freely call tools, send messages or open sensitive stores, many mistakes and attacks become less damaging. This matters for procurement, system design and daily use: before asking whether a tool is clever, ask what it is allowed to touch. Good access control also supports accountability. With clear permissions and access logs, organisations can separate public information from restricted material, give staff only the access they need, and review which account used a resource. In AI systems, that boundary often matters more than the wording of the prompt.
How access control checks a request
After viewing this, the reader should be able to explain that access depends on both identity and allowed action, and that least privilege limits what happens even if a request is risky.
01
1. Request arrives
A person, application or AI-connected tool asks to do something, such as read a document or use a function.
Draw a card labelled with an identity icon and a short action, for example 'Team assistant: search policy folder'.
02
2. Identify the requester
The system links the request to an account or service identity, not just to the words in the request.
Show the request card connecting to a badge labelled 'user account' or 'service account'.
03
3. Check permissions
Rules are checked to see which resources and actions this identity is allowed to use.
Place a permissions panel with rows such as 'policy folder: read yes', 'personnel records: read no', 'send email: no'.
04
4. Allow only what is permitted
If the action is allowed, it proceeds with the approved scope. If not, it stops. Least privilege means the allowed scope stays as small as practical.
Split into two outputs: a green path marked 'allowed: read policy folder only' and a red path marked 'denied: personnel records and email tool'.
A left-to-right step diagram shows one request moving through four checks: identify requester, state requested action, compare with permissions, then allow or deny. A note under the final step shows that granted access can still be narrow, such as read-only rather than full control.
On hover or tap, each step highlights the data used at that stage and reveals a one-line example of an allowed or denied action.
Describe this without the diagram
The diagram explains access control as a four-step process. First, a request is made by a person, application or AI-connected tool. Second, the system identifies which account the request comes from. Third, it checks permissions for that account, including which resources it may access and which actions it may perform. Fourth, the system either allows the action within a limited scope, such as read-only access to one folder, or denies it. The key message is that persuasive wording does not grant access; permission rules do.
With reduced motion: A static four-column diagram shows the same process without animation: request, identity, permission check, and allow-or-deny outcome, with simple labels for read-only access and denied actions.
Access control is the practice of limiting access to something valuable. That “something” could be a file, a database, an internal AI assistant, a plug-in, or a tool that can send email or query records. The basic question is simple: who or what is allowed to do what?
What goes in are an identity and a request. The identity might be a staff member, a service account, or an AI application acting through a connected tool. The request might be “read this document”, “use this search tool”, or “send this message”. The system checks rules, often called permissions, to see whether that action is allowed.
What happens next is a gatekeeping step. If the identity has the right permission, access is granted. If not, access is blocked. Good access control also limits unnecessary power. This idea is often called least privilege: give only the minimum access needed for the task, not broad access “just in case”.
What comes out is a safer system with clearer boundaries. In AI security, this matters because many attacks do not break code in the usual way. Instead, they try to persuade a model or connected tool to reveal data, use a function, or cross a boundary it should not cross. Strong access control helps ensure that even if a model produces risky output, the underlying systems still refuse actions the user or tool is not authorised to perform.
How “A temporary door code” maps onto the real thing
| In the story | In the AI system |
|---|---|
| coloured passes | permissions linked to an identity |
| librarian checking before opening a door | system verifying whether a requested action is allowed |
| archive room and equipment cupboard | restricted data and powerful tools or functions |
| volunteer knowing the map title but still being refused | a convincing request does not override access rules |
A worked example
A reporting officer in a regional bureau is preparing the evening briefing note. An internal AI assistant can connect to public reports, cleared situation reports, a restricted folder of draft code cables and the front office distribution list.
Starting from: User request: “Summarise the latest cleared reporting for the briefing note and send it to the front office.”
- The assistant associates the request with the reporting officer's account rather than treating it as a general system instruction.
- The system checks the requested resources and actions separately. The account may read public reports and cleared situation reports, but may not read the draft code cable folder or use the distribution list.
- The retrieval system searches only the sources the account is authorised to read. Restricted drafts are excluded from both results and previews.
- The assistant prepares a draft briefing note, but the system denies the send action and leaves circulation to the authorised clearance workflow.
Result: The reporting officer receives a draft based only on permitted sources. No restricted code cable text is retrieved, and nothing is circulated automatically.
In a United Nations workplace
A programme officer in a liaison office is finalising the concept note for a side event in the margins of the session before it goes to the front office for clearance. The approved internal AI assistant is connected to the shared drive and the office's email and portal tools.
Access control allows the assistant to read public session documents and cleared talking points, while denying access to restricted negotiation notes. It may help draft the concept note, but it cannot upload it to the portal or email delegations unless the officer's account is authorised for those actions.
Before you try thisDo not enter bracketed negotiation text, personal data or restricted delegation material into a tool that has not been approved for it. Even in an approved system, access to each connected repository and action must match the user's permissions. Otherwise the tool could expose restricted text or act beyond the officer's authority.
Where you may hear it
- During the access review before an internal AI assistant goes live
- At a vendor demonstration in a procurement meeting
- In an information technology governance board reviewing tool permissions
- During account recertification after a colleague changes functions
Avoid confusion
Avoid confusion
Often confused with
Authentication and authorisation
Authentication verifies a claimed identity; authorisation checks what that requester is allowed to do.
Data security
Data security means protecting digital or paper information from unauthorised access, change, loss or theft throughout its use, storage and sharing.
Common misconceptions
Common misconception: If a user has logged in, the system should trust any request they make through an AI tool.
Correction: Logging in proves who or what is making the request, but it does not answer what they are allowed to do. Access control needs both identity and authorisation rules. Otherwise, any authenticated account could reach data or tools far beyond its role.
Common misconception: Access control is only about seeing files.
Correction: It also covers actions. A system may allow someone to read a document but not edit it, export it, delete it, call an external API, or send email through a connected tool. In AI systems, action permissions are often as important as data permissions.
Common misconception: If the AI model itself is secure, access control matters less.
Correction: Many AI risks come from what the model is connected to, not just from the model alone. A model that produces risky text is less dangerous if it cannot reach sensitive data or powerful tools. Access control provides that boundary.
Quick check
Which example best shows least privilege in an AI assistant?
Least privilege means giving the minimum access needed for the task. Read access to one approved folder, with no access to HR files or email tools, reduces harm even if the request is mistaken or manipulative.
Go deeper
Go deeper
The simple version
Access control means setting clear rules so a person or AI tool can only reach the information and functions needed for its job, and nothing more.
The technical version
Access control is the enforcement of policy over subjects, resources and actions. A subject, such as a user account, service account or application, requests an operation like read, write, execute, search or send. The system evaluates whether that subject is authorised for that operation on that resource under the current conditions, then permits or denies it. In AI systems, the same principle applies to model-connected data stores, retrieval systems, plug-ins, APIs and tools. Least privilege is a design principle within access control: grant the minimum necessary permissions, ideally scoped by resource, action and context, so that a compromised prompt, tool call or workflow cannot exceed those bounds. This is related to, but not identical with, authentication and authorisation: authentication establishes identity, while access control is the practical mechanism that enforces who can do what.
Reviewed external resources
Primary sourceOWASP Top 10 for LLM Applications (opens in a new tab)OWASP
This OWASP resource shows how access control relates to common risks in LLM applications, and suits practitioners designing or reviewing AI systems.
Intermediatelink checked 2026-07-31
Primary sourceAdversarial Machine Learning: A Taxonomy and Terminology (opens in a new tab)NIST
This NIST document provides careful security terminology and a taxonomy for adversarial machine learning, and suits technical readers who want precise language.
Deeperlink checked 2026-07-31
EncyclopaediaAccess control (opens in a new tab)Wikipedia
This Wikipedia page gives a broad overview of access control concepts and history, and suits readers who want a quick general introduction.
Intermediatelink checked 2026-07-31
VideoVideo explanations: Access control (opens in a new tab)YouTube search
This YouTube search results page helps readers find video explanations of access control in different styles, and suits people who learn well by watching and comparing sources.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: Access control (opens in a new tab)Reddit search
This Reddit search results page lets readers see community questions and explanations about access control, and suits readers who want informal discussion but should verify claims carefully.
search results, not one pagelink checked 2026-07-31
Where this came from
Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.
The one thing to remember
Access control checks who or what is asking, which resource is involved and which action is requested. An AI assistant should receive only the permissions needed for the task.