Permission-aware agents in the enterprise

An agent that ignores the user’s permissions is a data leak with a friendly UI. Here’s how to build one that respects the tenant.

The rule

Every retrieval an agent makes must be executed <em>as the user</em>, not as a service principal with elevated access. This is the difference between a helpful copilot and a compliance nightmare.

How to actually do it

Delegated Graph tokens, not app-only. Row-level security on the underlying data. OBO (on-behalf-of) flows when hopping between APIs. If your architecture cannot answer "whose identity ran this query?" — pause and fix that before shipping anything else.

The one test worth running

Pick two real users with different access rights. Ask the agent the same question from both accounts. If the answers overlap in ways they shouldn’t, you have a bug — not an edge case.