My AI Agent Never Touches the Database

Описание и применение

Агент ИИ в платформе The Arsenal читает данные, но никогда не обращается напрямую к базе, используя ограниченный набор функций и строгий контроль доступа, чтобы предотвратить раскрытие конфиденциальной информации

Задача

Prevent sensitive data disclosure by an AI agent that only reads data

Результат

The agent never touches the database directly; all data access is mediated by a secure layer that enforces identity, column tagging, and error handling, effectively preventing sensitive information disclosure

Рабочий процесс

• 1. User asks a question via the agent
• 2. Agent formulates a function call with parameters (e.g., lead ID) but no user identity
• 3. Data access layer stamps caller identity from session and filters rows
• 4. Function declares required data tier; layer returns only columns tagged public or production
• 5. If a column lacks a tag it is treated as PII and omitted
• 6. Errors are generic; detailed logs contain request IDs
• 7. Existence leaks are mitigated by returning the same error for out‑of‑scope lookups
• 8. Transcripts and logs are subject to the same controls and purged after 30 days

Доказательства

The model never touches the database. It calls a small set of narrow functions, things like "get my pipeline stats for this week."

Источник

Every column in the schema carries one tag: public, production, or client PII. Each function declares its tier, and the data layer refuses to return anything above it.

Источник

Error messages: users see a generic message; the real error goes to a server log with a request ID.

Источник