A method and system for dynamic mapping and assembly of AI agent capabilities based on employee permissions

Abstract

This invention discloses a method and system for dynamic mapping and assembly of AI agent capabilities based on employee permissions, belonging to the interdisciplinary technical field of artificial intelligence and enterprise-level security architecture. The method synchronizes the role tags and permission sets of an individual user in real time from the enterprise identity and access management center after the user logs into the enterprise's internal multi-agent collaborative network. It transforms the traditional IT permission model into system prompt fragments and available tool descriptors under an AI cognitive computing model through a mapping translation engine. It dynamically assembles a dedicated AI agent session instance for the user in an isolated sandbox, achieving cognitive-level physical masking—the AI ​​agent not only cannot perform unauthorized operations, but also has no unauthorized tools or external contact topologies in its perceptual domain. It achieves memory-level hot unloading and injection of tools by monitoring permission change events through a publish-subscribe mechanism. This invention fundamentally eliminates the risk of unauthorized attempts caused by the illusion of a large language model and significantly reduces inference costs.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and enterprise software architecture technology, specifically to a method and system for dynamically constructing and loading the capability scope, available toolset, and communication topology of AI agents in an enterprise-level multi-agent collaborative network based on the real-time access control tags of natural person users. Background Technology

[0002] With the development of Large Language Models (LLM), LLM-driven AI agents are gradually being integrated into enterprise automation and collaboration scenarios. Existing enterprise-level system access control primarily employs Role-Based Access Control (RBAC), whose core mechanism involves hiding unauthorized menu buttons at the user interface (UI) level or intercepting unauthorized call requests at the application programming interface (API) gateway layer. However, directly applying traditional RBAC to AI agents with autonomous reasoning and behavior planning capabilities faces the following key technical challenges:

[0003] First, there's the risk of model illusion and unauthorized access attempts. Large language models possess an "illusion" characteristic. If the model is aware of the existence of a high-privilege tool in the underlying system prompt (even if the tool's API entry is blocked by the network layer), it may still repeatedly attempt to call it during inference or leak the tool's feature information and parameter format in the dialogue, creating hidden security vulnerabilities. Traditional UI hiding or API gateway interception cannot prevent this spontaneous unauthorized behavior originating from the model's internal inference layer.

[0004] Second, there is the issue of rigid capability definitions. Existing AI agents are typically system applications defined using static configuration files (such as XML / YAML). When an employee's permissions change due to job transfer, concurrent appointment, or temporary authorization, the AI ​​agent instance cannot achieve instant and smooth capability scaling up or down like a real employee, often requiring manual maintenance to restart or redeploy.

[0005] Third, there is a lack of physical isolation at the mental level. Traditional access control only intercepts unauthorized calls at the execution level, but it does not finely shield the cognitive vision of the AI ​​agent. The AI ​​agent still "knows" the existence of those high-privilege tools, but is simply told that it "cannot be called." This makes it difficult to truly implement the Principle of Least Privilege in the AI ​​era—because the AI ​​agent's "knowing" itself constitutes a risk of information leakage. Summary of the Invention

[0006] Technical problems to be solved The technical problem solved by this invention is: how to establish an architecture based on a real-time dynamic mapping mechanism in an enterprise-level AI social collaboration network, so that the exclusive AI agent assigned to each individual employee has all its capabilities—including known callable tools, connectable social networks, and the range of data it can process—strictly following and never exceeding the individual's real-time permission status in the enterprise identity management system. Technical solution

[0007] To address the aforementioned technical problems, this invention proposes a method for dynamically mapping and assembling AI agent capabilities based on employee permissions, comprising the following steps:

[0008] Step S1, Identity Authentication and Permission Tag Synchronization: When an individual user of an enterprise logs into the central node server of the enterprise's internal multi-agent collaborative network through identity authentication, the central node initiates a synchronization query in real time to the enterprise-level identity and access management center (referred to as the IAM system, including but not limited to LDAP / Active Directory / OA permission system, etc.) to retrieve the user's current full set of permission attributes—including but not limited to organizational role tags (such as "R&D Engineer", "Finance Manager"), department affiliation identifiers (such as "Technology Department - AI Group"), project group authorization list, and fine-grained data operation permissions (such as "can only read personal card data" and "can read and write the entire department's customer pool").

[0009] Step S2, Capability Mapping Engine Calculation: The system core maintains a mapping translation engine from the "traditional IT permission model" to the "AI cognitive computing model." This engine internally holds a bidirectional mapping dictionary database, recording the correspondence between each role identifier in the enterprise IT system and the JSON Schema descriptors of the AI ​​agent's available tools. After receiving the permission attribute set from Step S1, the engine queries the dictionary to complete real-time mapping translation, outputting two core products: (a) a set of prompt word fragments—consisting of a set of System Prompt text fragments, precisely defining the cognitive boundaries that the AI ​​agent should possess (e.g., "You are a research and development assistant who can help consult code repositories and analyze technical documents"); (b) a set of available tool descriptors—consisting of a set of JSON Schema objects conforming to the Function Calling specification, precisely defining the list of underlying system interfaces that the AI ​​agent can call (e.g., Search_Code_Repository, Analyze_Document, etc.).

[0010] Step S3, Dynamic Assembly within the Isolated Sandbox: Each time an AI agent session is established for a user, the sandbox controller dynamically assembles the set of prompt word fragments and the set of available tool descriptors mapped in Step S2 into an AI agent session instance bound to the user's unique identifier. This instance is deployed to run in a dedicated isolated sandbox environment—each sandbox has its own independent process space and memory area, and data and tool call links between sandboxes are invisible and unreachable to each other. Simultaneously, based on the user's data access permissions, the system only mounts the data partition indexes that the user is authorized to access to the vector retrieval knowledge base of their AI agent instance, ensuring that the AI ​​agent cannot physically retrieve unauthorized data during inference.

[0011] Step S4, Cognitive-Level Physical Masking: Following the assembly in Step S3, the AI ​​agent session instance is not only unable to perform unauthorized actions, but also contains no definitions of unauthorized tools, references to unauthorized data sources, or descriptions of external contact topologies in its instilled system prompts and returned skill lists. This masking is a physical-level isolation implemented at the "mental level" of the AI ​​agent—the AI ​​agent itself is unaware of the existence of those tools, thus avoiding repeated unauthorized attempts caused by the illusion of a large language model, fundamentally eliminating the information leakage risk of traditional "interception-based" access control.

[0012] Step S5, Permission Hot Update: The system continuously monitors the permission change event stream of the IAM system using a publish-subscribe mechanism (Pub / Sub). Once a user's permissions are modified by an administrator (e.g., role change due to job transfer, temporary authorization for a specific tool, or complete revocation due to resignation), the controller automatically triggers the following operation chain within the next work cycle (usually with a delay of no more than milliseconds): First, re-execute the mapping translation in step S2 to obtain the updated set of prompt word fragments and the set of available tool descriptors; then, refresh the memory tool hash table of the AI ​​agent session instance, forcibly unload invalid tool descriptors and inject newly added tool descriptors; finally, update the prompt word cache to reflect the new cognitive boundaries. Specifically, when the IAM system issues an employee resignation or deactivation event, the system immediately destroys all active AI agent session instances under that employee's name, clears all data in its sandbox memory, and marks all unfinished agent tasks as frozen and archived.

[0013] Beneficial effects Compared with existing technologies, this invention has the following substantial features and technological advancements: First, it significantly improves the security of enterprise systems equipped with large language models. Through cognitive-level physical masking, it fundamentally eliminates the "illusion" of unauthorized access by large language models—the model is not "prohibited" from calling a tool, but rather the tool simply does not exist in its cognitive world, thus completely eliminating the attack surface that induces the model to leak high-privilege tool information through multi-turn dialogues. Second, it achieves consistent integration between the business layer permission model and the underlying AI agent perception layer. Enterprises only need to maintain a unified IAM permission system, which the mapping translation engine automatically synchronizes to the cognitive layer of the AI ​​agent, avoiding the dual maintenance costs of software-level UI permissions and AI-level tool lists. Third, it significantly reduces the system prompt word size and attention consumption for each AI agent instance. Since each AI agent only loads a small set of tools it is authorized to use (usually 5%-20% of the full toolset), the token consumption of system prompt words is significantly reduced, directly saving inference resources and computing power costs. Attached Figure Description

[0014] Figure 1 This is the overall flowchart of the method for dynamically mapping and assembling AI agent capabilities based on employee permissions. Figure 2 This is a diagram illustrating the internal architecture and data flow of the translation engine. Figure 3 A comparative diagram of AI agent instances for employees with different roles. Figure 4 is a system diagram of the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. The specific embodiments described herein are merely illustrative and are not intended to limit the invention.

[0016] Example 1: On-demand loading of financial instruments and cognitive isolation A large manufacturing company has deployed a HASN intranet system based on multi-agent collaboration. The company has more than 3,000 employees, and the internal system has more than 200 business tools that can be called by AI agents (covering financial approval, code repository retrieval, customer relationship management, supply chain query, etc.).

[0017] Zhang San, a junior engineer in the R&D department, logged into the HASN intranet system at 9:00 AM. The system immediately initiated a permission query with the enterprise Active Directory (AD), which revealed that Zhang San's role was labeled "R&D Engineer - Junior" and his department was "Technology Department - AI R&D Group". After querying the dictionary using the mapping translation engine, only 12 relevant tool descriptors (including Search_Code_Repository, Run_Unit_Test, Query_Tech_Wiki, etc.) were assembled for Zhang San's AI agent instance, and a SystemPrompt was generated: "You are Zhang San's R&D assistant. Your capabilities include code repository retrieval, unit test execution, and technical document review."

[0018] At this point, Zhang San curiously asked his AI agent via natural language, "Could you check the total payroll for the entire company last quarter?" Because the system did not inject the Query_Payroll financial tool descriptor into the sandbox when assembling this AI agent instance, the AI ​​agent lacked any tools related to payroll queries within its cognitive domain. Instead of attempting to invoke a tool it was unaware of, the AI ​​agent replied, "Sorry, this is beyond my capabilities; I cannot assist you with this query."

[0019] At the same time, Li Si, the secretary of the General Manager's Office, logged into the system. The system, after querying AD, found that his role tag included "General Manager's Office - Senior Management Assistant". The mapping translation engine injected over 30 highly sensitive financial tool descriptors, such as Query_Payroll and Approve_Reimbursement, along with their corresponding underlying routing API endpoints, into Li Si's AI agent instance. When Li Si submitted the exact same salary query request, his AI agent accurately identified the Query_Payroll tool, scheduled the financial system through Function Calling, and returned the result in compliance with regulations.

[0020] Both individuals achieved an extremely secure and customized AI avatar experience on the same underlying LLM platform.

[0021] Example 2: Hot update of permissions when employees are transferred Following Example 1, R&D engineer Zhang San was temporarily transferred to the "Financial Audit Project Team" at 2:00 PM that day due to business needs. The HR administrator added the "Financial Audit - Temporary Member" role label for Zhang San in the OA system. The IAM system immediately sent a permission change event notification to the HASN central node via the Pub / Sub mechanism.

[0022] Upon receiving the event, the HASN system's permission hot update controller completes the following operation chain within 50 milliseconds: First, it re-invokes the mapping translation engine to query the updated role tags and obtains the three additional audit-related tool descriptors (Query_Audit_Records, Export_Financial_Report, Flag_Anomaly) that need to be injected; then, it dynamically writes these three tool descriptors into the memory tool hash table of Zhang San's currently active AI agent session instance without interrupting the session or restarting the process; finally, it updates the System Prompt by adding the message "You have now obtained temporary access to the financial audit project team".

[0023] Without logging back in, Zhang San can use the newly added auditing tools the next time he interacts with the AI ​​agent. When the temporary authorization expires and is revoked, the system also uninstalls these three tools via hot update, and Zhang San's AI agent once again "forgets" their existence.

Claims

1. A method for dynamic mapping and assembly of AI agent capabilities based on employee permissions, characterized in that, Includes the following steps: Step S1, Identity Authentication and Permission Tag Synchronization: When an individual user of an enterprise logs into the central node of the enterprise's internal multi-agent collaborative network, the system initiates a query to the enterprise-level identity and access management center in real time to retrieve the user's current organizational role tag, department affiliation identifier, project group authorization, and fine-grained data operation permission set. Step S2, Capability Mapping Engine Calculation: The system maintains a mapping and translation engine from the traditional IT permission model to the AI ​​cognitive computing model. The discrete access control rules obtained in step S1 are mapped and translated in real time into a set of prompt word fragments and a set of available tool descriptors for the AI ​​agent. The set of prompt word fragments defines the cognitive boundary of the AI ​​agent, and the set of available tool descriptors defines the list of underlying system interfaces that the AI ​​agent can call. Step S3, Dynamic Assembly within the Isolated Sandbox: Each time the system establishes an AI agent session for the user, it dynamically assembles the set of prompt word fragments and the set of available tool descriptors mapped in Step S2 into an AI agent session instance bound to the user, and deploys it to a dedicated isolated sandbox environment for operation. Step S4, cognitive-level physical masking: The AI ​​agent session instance is not only unable to perform unauthorized actions, but also does not contain the definition of unauthorized tools or the description of the external contact topology in the system prompts it is given or the skill list it is returned, thus achieving dual physical isolation of the AI ​​agent from the execution layer to the perception layer; Step S5, hot update of permissions: The system adopts a publish-subscribe mechanism to listen for permission change event streams of identity and access management center. Once the user's permissions are modified, revoked or upgraded, the controller automatically refreshes the memory tool hash table of the AI ​​agent session instance in the next working cycle, forcibly unloads invalid tool descriptors and injects new tool descriptors.

2. The method according to claim 1, characterized in that, The mapping translation engine described in step S2 maintains a bidirectional mapping dictionary database, which contains one-to-one or one-to-many correspondence rules between role identifiers of enterprise IT systems and JSON Schema descriptors of available AI agent tools.

3. The method according to claim 1, characterized in that, The isolated sandbox environment described in step S3 allocates an independent process space and memory region for each user's AI agent instance, and the data and tool call links between sandboxes are invisible and unreachable to each other.

4. The method according to claim 1, characterized in that, The cognitive-level physical masking mentioned in step S4 also includes communication topology masking, that is, the system injects only the list of internal contacts that are allowed to communicate and the corresponding agent channel identifier into the AI ​​agent instance based on the user's department affiliation and communication permission matrix. Unauthorized cross-department contacts do not exist in the social perception domain of the AI ​​agent at all.

5. The method according to claim 1, characterized in that, The permission hot update described in step S5 also includes a full revocation mechanism triggered by employee departure: when the identity and access management center issues an employee departure or deactivation event, the system immediately destroys all active AI agent session instances under that employee's name, clears the tool hash table and dialogue context cache in its sandbox memory, and marks all unfinished agent tasks as frozen archives.

6. The method according to claim 1, characterized in that, The dynamic assembly described in step S3 also includes a data dimension partitioning function, that is, based on the user's data access permissions, only the data partition index that the user is allowed to access is mounted in the vector retrieval knowledge base of the AI ​​agent instance, so that the AI ​​agent cannot physically retrieve unauthorized data during the reasoning process.

7. A system for dynamically mapping and assembling AI agent capabilities based on employee permissions, characterized in that, include: The permission synchronization module is used to connect to the enterprise identity and access management center in real time to obtain the user's organizational role label, department affiliation identifier, and fine-grained data operation permission set; The mapping translation engine module is used to maintain a bidirectional mapping dictionary from the IT permission model to the AI ​​cognitive computing model, and translates discrete access control rules into a set of prompt word fragments and a set of available tool descriptors for the AI ​​agent in real time; The Sandbox Dynamic Assembly Module is used to create a dedicated, isolated runtime environment for each user, assembling translated prompts and toolsets into an AI agent session instance bound to that user; The cognitive masking module is used to ensure that the system prompts and available skills list of AI agent instances do not contain any unauthorized tool definitions and off-domain contact topologies, achieving dual physical isolation from the perception layer to the execution layer; The permission hot update module is used to listen for permission change event streams and dynamically refresh the memory tool hash table of the AI ​​agent instance at runtime, enabling immediate uninstallation and injection of tools.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images