Fine-Grained Authorization: The Missing Piece in Agentic AI Security - Shivay Lamba - NDC Sydney
As Generative AI and agentic systems become more integrated into enterprise workflows, securing data access is paramount due to increased attack vectors. This talk emphasizes that traditional Role-Based Access Control (RBAC) is insufficient for modern AI applications. The solution proposed is Fine-Grained Authorization (FGA), specifically utilizing Relationship-Based Access Control (ReBAC). OpenFGA is presented as a robust, scalable tool that allows developers to enforce document-level permissions at runtime, ensuring that LLMs and agents can only access data explicitly authorized by the user's role and context. This approach is critical for securing Retrieval-Augmented Generation (RAG) pipelines against sensitive information disclosure.
Key takeaways
-
AI Agents Require Guardrails
1:47
Agentic systems, while powerful, must be constrained by proper security guardrails. Analogies like the Harbor Bridge and designated swimming areas illustrate that actions must be limited to authorized boundaries.
-
FGA is Necessary for GenAI Security
20:40
The most critical security risk in LLM applications, from an application developer's perspective, is Sensitive Information Disclosure. FGA ensures the AI respects user roles and permissions when accessing private data.
-
ReBAC Scales Beyond RBAC
35:30
Authorization evolved from Access Control Lists (ACL) to Role-Based Access Control (RBAC), which is coarse-grained. Relationship-Based Access Control (ReBAC) is the natural successor, allowing complex access decisions by defining relationships between subjects (users/groups) and objects (documents/folders).
-
Pre-filtering Secures RAG Pipelines
When implementing RAG, pre-filtering is the superior security approach. Instead of post-filtering results (where unauthorized documents might still be retrieved), a pre-filter check limits the vector search to only those documents viewable by the user's permissions.