An AI assistant should own no permissions. It borrows the rights of the person using it, for the duration of the request, and nothing more. The shortcut that replaces it, one shared service account for everyone, eventually hands a language model more access than any single employee has, which is exactly backwards.

Key takeaways

A shared service account accumulates the union of every user's needs, so the assistant behind it ends up with more access than any individual person.

Prompt injection is a matter of when, not if: ARGUS, one of the strongest published defences, cuts attack success from 28.8% to 3.8% on its benchmark, which is impressive and still not zero.

Because no defence reaches zero, the permission model decides what a successful attack is worth, and per-person scope makes that price small.

Tool lists derived from the user's role make out-of-scope actions invisible rather than forbidden: a tool that is not listed cannot be called.

Identity, role and scope belong in fields the server fills…