| I agree with almost all of this. You could allow unconstrained selects, but as you note you either need row level security or you need to be absolutely sure you can prevent returning any data from unexpected queries to the user. And even with row-level security, though, the key is that you need to treat the agent as an the agent of the lowest common denominator of the set of users that have written the various parts of content it is processing. That would mean for support tickets, for example, that it would need to start out with no more permissions than that of the user submitting the ticket. If there's any chance that the dataset of that user contains data from e.g. users of their website, then the permissions would need to drop to no more than the intersection of the permissions of the support role and the permissions of those users. E.g. lets say I run a website, and someone in my company submits a ticket to the effect of "why does address validation break for some of our users?" While the person submitting that ticket might be somewhat trusted, you might then run into your scenario, and the queries need to be constrained to that of the user who changed their address. But the problem is that this needs to apply all the way until you have sanitised the data thoroughly, and in every context this data is processed. Anywhere that pulls in this user data and processes it with an LLM needs to be limited that way. It won't help to have an agent that runs in the context of the untrusted user and returns their address unless that address is validated sufficiently well to ensure it doesn't contain instructions to the next agent, and that validation can't be run by the LLM, because then it's still prone to prompt injection attacks to make it return instructions in the "address". I foresee a lot of money to be made in consulting on how to secure systems like this... And a lot of bungled attempts. Basically you have to treat every interaction in the system not just between users and LLMs, but between LLMs even if those LLMs are meant to act on behalf of different entities, and between LLMs and any data source that may contain unsanitised data, as fundamentally tainted, and not process that data by an LLM in a context where the LLM has more permissions than the permissions of the least privileged entity that has contributed to the data. |