[montroser]

Well, it's not that hard: just give the LLM a user-scoped access token, same as if the user themselves were asking their own LLM to act on their behalf.

Basically, just like we don't show users information they shouldn't be able to see, and don't let them take actions they shouldn't be able to take -- we can use exactly those same explicit mechanisms (scopes, roles, permissions) to limit what the LLM can see and do.

The LLM could try to do more than what's allowed, but they get shot down with an access denied message just like anyone else.

The anti pattern is to think that you can reimplement access control with prompt engineering and give the LLM root access. That is doomed to fail every time.