Answers.Body: <blockquote>
  <p>This is just an educated guess based on my general knowledge of AI - I didn't do any research to write this answer. I may update the answer, if I decide later to do some research on the topic. I may convert this to comment.</p>
  </blockquote>
  <p>I don't think current statistical-based AIs would be able to <strong>correctly</strong> implement any kind of authentication or authorization right now.</p>
  <p>You will probably need to implement this in an ad-hoc or rule-based fashion.</p>
  <p>One possibility would be to have different AIs, each of which is trained with a specific set of documents, where a set would correspond to one role (i.e. a set of permissions or files/info that can be accessed). However, of course, this means that you will need to spend more resources (money and time). If you want to add a new role, you would also need to add a new AI. Moreover, if there are many roles, this may become impractical. So, you probably want to have a small set of roles, then maybe use something like the suggested alternative below.</p>
  <p>The other possibility may be to have an AI to detect sensitive data or requests that ask for sensitive data before dispatching the request to the model that gives you the info.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-12-05T22:50:32.970Z
Answers.Text: Exactly, you say it very well. Good! I upvoted your answer
Answers.UserDisplayName: Zollikofen4
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-12-04T11:42:22.183Z
Answers.LastActivityDate: 2023-12-04T11:42:22.183Z
Answers.UserDisplayName: nbro
Body: <p>I am responsible for a CMS that contains a lot of documents with knowledge and these documents are protected so not everyone can see them. Now we are tasked to find a technology partner who helps us &quot;feed&quot; those documents to an AI solution which users can use to &quot;query&quot; the knowledge contained. I have doubts if AI is able to provide answers depending on the permissions of the user.
  Is this a concept common to AI solutions?</p>
  <p>Some more details and a made up example: let's assume I have just two documents:</p>
  <ul>
  <li>one that tells me where I hide my money, shared with group gets_money</li>
  <li>one that tells where I hide my sweets, shared with people that are members of gets_sweets</li>
  </ul>
  <p>Left aside the fact that both the AI and the CMS would need to share support for the same authentication and authorization: how can I make sure that somebody who is only member of gets_money gets no reply to the prompt &quot;where are the sweets&quot; ?</p>
  
Tags: <ai-security>
Title: Retaining document level security of a CMS
UserDisplayName: Marged
ThreadText: # Retaining document level security of a CMS
  
  (Asked by: username_0 on 2023-11-28)
  
  I am responsible for a CMS that contains a lot of documents with knowledge and these documents are protected so not everyone can see them. Now we are tasked to find a technology partner who helps us "feed" those documents to an AI solution which users can use to "query" the knowledge contained. I have doubts if AI is able to provide answers depending on the permissions of the user.
  Is this a concept common to AI solutions?
  
  Some more details and a made up example: let's assume I have just two documents:
  
  * one that tells me where I hide my money, shared with group gets\_money
  * one that tells where I hide my sweets, shared with people that are members of gets\_sweets
  
  Left aside the fact that both the AI and the CMS would need to share support for the same authentication and authorization: how can I make sure that somebody who is only member of gets\_money gets no reply to the prompt "where are the sweets" ?
  
  **Tags:** ai-security
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-12-04. Score: 2
  
  > This is just an educated guess based on my general knowledge of AI - I didn't do any research to write this answer. I may update the answer, if I decide later to do some research on the topic. I may convert this to comment.
  
  I don't think current statistical-based AIs would be able to **correctly** implement any kind of authentication or authorization right now.
  
  You will probably need to implement this in an ad-hoc or rule-based fashion.
  
  One possibility would be to have different AIs, each of which is trained with a specific set of documents, where a set would correspond to one role (i.e. a set of permissions or files/info that can be accessed). However, of course, this means that you will need to spend more resources (money and time). If you want to add a new role, you would also need to add a new AI. Moreover, if there are many roles, this may become impractical. So, you probably want to have a small set of roles, then maybe use something like the suggested alternative below.
  
  The other possibility may be to have an AI to detect sensitive data or requests that ask for sensitive data before dispatching the request to the model that gives you the info.
  
  > **Comments:**
  > **username_2**: Exactly, you say it very well. Good! I upvoted your answer  
  
  ---
  
  