Enterprise-level agent permission management method and system

Abstract

The application discloses an enterprise-level intelligent agent (Agent) permission management method and system, the method comprising: receiving a permission request initiated by a target intelligent agent (Agent) for a target task, and determining corresponding request characteristic information; determining authorization decision information matched with the target task according to the request characteristic information and a preset permission management strategy; configuring or controlling the access permission of the target intelligent agent (Agent) in at least one target business system based on the authorization decision information; recording the permission request, the authorization decision information and the use information of the access permission, and generating corresponding permission audit information. The application can match the permission control with the target task and the business system access process, improve the permission configuration refinement degree, the permission adaptation capability in a complex business scenario and the permission use traceability effect.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and information security technology, and in particular to an enterprise-level intelligent agent permission management method and system. Background Technology

[0002] As enterprises continue to advance their digital transformation, tasks such as office collaboration, customer management, resource scheduling, data analysis, and workflow approval are increasingly relying on various information systems. Simultaneously, artificial intelligence applications, automated programs, and intelligent assistant tools are also beginning to participate in internal data retrieval, workflow processing, and business decision support. Because these intelligent applications may need to access data resources or functional interfaces of different business systems during operation, their access behavior often involves internal data security, business permission boundaries, and compliance management requirements. Therefore, how to effectively manage permissions for intelligent applications in the enterprise environment has become a crucial issue in enterprise information security management.

[0003] In related technologies, enterprises typically control system access behavior through account permission configuration, role-based permission configuration, access control lists, and manual approval processes. While these methods can meet certain permission management needs in traditional manual operation scenarios, they still have limitations when enterprises have a large number of business systems, complex organizational hierarchies, dispersed data resources, and the involvement of intelligent applications in business processing. On the one hand, permission configuration usually relies on preset rules or manual maintenance, making it difficult to adapt to the frequent changes in permission requirements under complex business scenarios. On the other hand, the permission models, resource granularity, and management methods are not entirely consistent between different business systems, easily leading to inconsistent permission configurations, unclear permission boundaries, and high costs for permission change and maintenance. Furthermore, some permission usage processes only generate ordinary operation logs, which are insufficient to fully reflect the permission application, approval, usage, and subsequent management, hindering enterprises from verifying abnormal access, unauthorized operations, and attribution of responsibility.

[0004] Therefore, in the permission management of enterprise intelligent applications, the following issues urgently need to be addressed: insufficient granularity of permission configuration, weak permission adaptation capability in complex business scenarios, poor collaboration in permission management among multiple business systems, and high difficulty in tracing the permission usage process. Summary of the Invention

[0005] This application provides an enterprise-level intelligent agent permission management method and system, aiming to solve the problems of insufficient granularity of permission configuration, weak permission adaptation capability in complex business scenarios, poor collaboration of permission management among multiple business systems, and high difficulty in tracing the permission usage process in the permission management of existing technologies in enterprise intelligent applications.

[0006] Firstly, an enterprise-level intelligent agent permission management method, the method comprising: Receive permission requests initiated by the target agent for the target task, and determine the request feature information corresponding to the permission requests; Based on the request feature information and the preset permission management strategy, authorization decision information matching the target task is determined. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. Based on the authorization decision information, the access permissions of the target intelligent agent in at least one target business system are configured or controlled; Record the permission request, the authorization decision information, and the usage information of the access permission to generate permission audit information corresponding to the target task.

[0007] Optionally, in the above scheme, determining the request feature information corresponding to the permission request includes: Parse the permission request to obtain the agent identification information of the target agent and the task attribute information of the target task; Based on the task attribute information, determine the target resource information and target business system information involved in the target task; Obtain the task context information corresponding to the permission request, wherein the task context information includes at least one of the following: task initiation object information, request time information, request environment information, and task urgency information; The request feature information is generated based on the agent identification information, the task attribute information, the target resource information, the target business system information, and the task context information.

[0008] Optionally, in the above scheme, determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy includes: Based on the target resource information and the target business system information, determine the resource sensitivity information corresponding to the permission request; Based on the task context information, determine the context risk information corresponding to the permission request; Based on the agent identification information and / or the task initiating object information, obtain historical permission behavior information, and determine behavior risk information based on the historical permission behavior information; Based on the resource sensitivity information, the context risk information, and the behavioral risk information, determine the risk assessment result corresponding to the permission request; Based on the risk assessment results, the authorization processing method corresponding to the target task is determined. The authorization processing method includes at least one of direct authorization, authorization with additional constraints, authorization after approval, or refusal of authorization.

[0009] Optionally, in the above scheme, determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy further includes: Based on the task attribute information, determine the task execution path information required to complete the target task; Based on the task execution path information and preset permission dependencies, determine a set of candidate permissions associated with the target task; Based on the target resource information and the target business system information, the candidate permission set is matched for resource scope and system scope to obtain the task matching permission set; Based on the risk assessment results and the authorization processing method, the task matching permission set is subjected to permission shrinking processing to obtain the target permission set; The authorization decision information is generated based on the target permission set and the authorization processing method.

[0010] Optionally, in the above scheme, the step of shrinking the task matching permission set to obtain the target permission set includes: Determine the operation type, resource object, and data range corresponding to each permission item in the task matching permission set to obtain permission item description information; The permission item description information is matched with the task execution path information to determine the necessary and unnecessary permission items in the task matching permission set; The unnecessary permission items are removed, and the data range of the necessary permission items is limited according to the resource sensitivity information to obtain a shrinking permission set; The target permission set is obtained by configuring at least one of the following in accordance with the authorization processing method: validity period, number of uses, access scenario, and recycling conditions for the shrinking permission set.

[0011] Optionally, in the above scheme, configuring or controlling the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information includes: Based on the authorization decision information, an authorization control credential is generated for configuring or controlling access permissions to the target intelligent agent, wherein the authorization control credential includes the target permission set and the authorization constraints. Based on the target business system information, determine the system permission mapping rules corresponding to the authorization control credential; According to the system permission mapping rules, the authorization control credentials are converted into system permission control information that can be recognized by each target business system; The system access control information is sent to the corresponding target business system to obtain access configuration feedback information; Based on the permission configuration feedback information, the access control status of the target intelligent agent in the corresponding target business system is determined.

[0012] Optionally, in the above scheme, when there are multiple target business systems, the method further includes: Summarize the permission configuration feedback information returned by each of the target business systems to obtain the cross-system configuration results; Based on the cross-system configuration results, determine whether the permission configuration status between multiple target business systems meets the preset consistency conditions, and obtain the consistency judgment result. If the consistency judgment result indicates that the preset consistency condition is not met, the target business system and abnormal permission item with the configuration abnormality are determined, and cross-system permission abnormality information is obtained. Based on the cross-system permission exception information, a permission compensation instruction or a permission rollback instruction is generated, and the access permission control status and cross-system permission synchronization status are updated based on the permission compensation instruction or the permission rollback instruction.

[0013] Optionally, in the above scheme, the step of recording the permission request, the authorization decision information, and the usage information of the access permission to generate permission audit information corresponding to the target task includes: Collect the request records corresponding to the permission requests, the decision records corresponding to the authorization decision information, the configuration records of the access permissions, and the invocation records of the access permissions to obtain a set of permission events; Determine the task identifier information corresponding to the target task, and associate each permission event in the permission event set according to the task identifier information to obtain the task permission event chain; Based on the task permission event chain, detect whether the target intelligent agent has access beyond the scope, access beyond the time limit, access with abnormal frequency, or cross-system abnormal access, and obtain the permission usage detection result. Based on the task permission event chain and the permission usage detection results, the permission audit information is generated.

[0014] Optionally, in the above scheme, the method further includes: Based on the permission request or the request feature information, determine the task initiation object information and target resource information corresponding to the target task; Based on the task initiation object information and the target resource information, determine the organizational hierarchy information corresponding to the target task; Based on the organizational hierarchy information, determine the organizational permission boundary information corresponding to the target task; When the target task involves cross-organizational access, cross-organizational authorization conditions are determined based on the organizational permission boundary information to obtain cross-organizational permission control information; Based on the cross-organizational permission control information, the authorization decision information or the access permission control status is adjusted to obtain a permission management result that adapts to the organizational hierarchy.

[0015] Secondly, an enterprise-level intelligent agent permission management system, the system comprising: The request processing module is used to receive permission requests initiated by the target agent for the target task, and determine the request feature information corresponding to the permission request; The authorization decision module is used to determine authorization decision information matching the target task based on the request feature information and the preset permission management strategy. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. The access control module is used to configure or control the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information. The audit traceability module is used to record the permission request, the authorization decision information, and the usage information of the access permission, and generate permission audit information corresponding to the target task. Compared with the prior art, this application has at least the following beneficial effects: Based on further analysis and research of existing technical problems, this application recognizes that existing technologies in enterprise intelligent application permission management suffer from insufficient fine-grained permission configuration, weak permission adaptability in complex business scenarios, poor collaboration in permission management between multiple business systems, and high difficulty in tracing permission usage. This application addresses these issues by first determining the request characteristic information corresponding to the permission request when the target intelligent agent initiates a permission request for a target task. This enables the permission management platform to identify the task requirements and access conditions associated with this access behavior. Then, based on the request characteristic information and preset permission management strategies, it determines the authorization decision information matching the target task. This ensures that the authorization result corresponds to whether the target intelligent agent is allowed to execute the target task, the allowed permission scope, and the corresponding authorization constraints, rather than relying solely on fixed accounts or static role configurations. Subsequently, based on the authorization decision information, it configures or controls the access permissions of the target intelligent agent in at least one target business system, ensuring that the authorization decision is implemented in the access process of specific business systems. Simultaneously, it records permission requests, authorization decision information, and access permission usage information to generate permission audit information corresponding to the target task, enabling the permission application, authorization, and usage processes to be traced and linked. Therefore, this application can improve the granularity of enterprise intelligent application permission configuration, enhance permission adaptation capability in complex business scenarios, improve the coordination of permission control among multiple business systems, and reduce the security management risks caused by the difficulty in tracing the permission usage process. This solves the problems in the background technology of insufficient granularity of permission configuration, weak permission adaptation capability in complex business scenarios, poor coordination of permission management among multiple business systems, and high difficulty in tracing the permission usage process. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an enterprise-level intelligent agent permission management method provided in one embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] In one embodiment, such as Figure 1 As shown, an enterprise-level intelligent agent permission management method is provided, including the following steps: Receive permission requests initiated by the target agent for the target task, and determine the request feature information corresponding to the permission requests; Based on the request feature information and the preset permission management strategy, authorization decision information matching the target task is determined. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. Based on the authorization decision information, the access permissions of the target intelligent agent in at least one target business system are configured or controlled; Record the permission request, the authorization decision information, and the usage information of the access permission to generate permission audit information corresponding to the target task.

[0019] In one possible embodiment, this application provides an enterprise-level intelligent agent permission management method, which can be applied to a permission management platform. The permission management platform can be deployed on an enterprise intranet server, private cloud platform, enterprise unified identity and access management platform, or enterprise AI security management platform, for unified reception, evaluation, authorization control, and auditing of permission requests from target intelligent agents within the enterprise environment. The target intelligent agent can be an artificial intelligence agent used to perform enterprise business tasks, such as an intelligent assistant, business agent, or tool invocation agent used to handle office approvals, customer management, financial inquiries, resource scheduling, data analysis, work order processing, or cross-system business collaboration. The target business system can include the enterprise's internal office automation system, enterprise resource management system, customer relationship management system, data warehouse system, process approval system, work order system, or other business systems.

[0020] In one possible embodiment, the permission management platform receives a permission request initiated by a target agent for a target task and determines the request characteristic information corresponding to the permission request. Specifically, when the target agent needs to call a business system, read a data resource, perform a business action, or access a functional interface according to user instructions or business processes, it can initiate a permission request to the permission management platform. After receiving the permission request, the permission management platform can parse the task description, calling object, resource identifier, business system identifier, operation type, and task execution environment carried in the permission request to form request characteristic information. The request characteristic information is used to characterize the business meaning, access object, and execution conditions of this permission request and serves as input for subsequent authorization decisions.

[0021] In one possible embodiment, the permission management platform determines authorization decision information matching the target task based on request feature information and preset permission management policies. The preset permission management policies may include at least one of the following: permission hierarchy policy, correspondence between task type and permission scope, resource sensitivity level policy, task context risk assessment policy, least privilege control policy, approval triggering policy, permission validity period configuration policy, cross-system permission control policy, and audit log policy. The permission management platform can determine whether the target agent is allowed to execute the target task based on the request feature information, and determine the corresponding permission scope and authorization constraints when allowing execution of the target task. The permission scope may include allowed access to business systems, resource objects, functional interfaces, operation types, and data ranges; the authorization constraints may include at least one of the following: validity period, number of uses, access time period, access environment, approval status, eviction conditions, and abnormal termination conditions.

[0022] In one possible embodiment, the access control platform configures or controls the access permissions of a target intelligent agent in at least one target business system based on authorization decision information. Specifically, when the target task involves only a single business system, the access control platform can convert the authorization decision information into access control information recognizable by that target business system, and implement access control through methods such as interface calls, token issuance, policy synchronization, or gateway control. When the target task involves multiple target business systems, the access control platform can perform unified access control on multiple target business systems, ensuring that the access permissions of the target intelligent agent in different target business systems are consistent with the authorization decision information, avoiding unauthorized access or task execution failure due to inconsistent permission scopes between different systems.

[0023] In one possible embodiment, the permission management platform records permission requests, authorization decision information, and access permission usage information, generating permission audit information corresponding to the target task. The permission audit information may include the permission request initiation time, target agent identifier, task identifier, target resource, target business system, authorization result, authorization constraints, permission configuration status, permission call records, permission revoke records, anomaly detection results, and audit report identifiers. By recording permission requests, authorization decisions, and permission usage processes in a linked manner, a complete lifecycle record of permissions surrounding the target task can be formed, facilitating subsequent abnormal access analysis, accountability tracing, and compliance auditing.

[0024] This embodiment determines request feature information when the target intelligent agent initiates a permission request, and forms authorization decision information matching the target task based on the request feature information and preset permission management policies. Then, it configures or controls access permissions in at least one target business system accordingly, and records permission usage information to form permission audit information. This makes permission management no longer rely solely on fixed accounts or static role configurations, but can perform permission control and audit traceability around the target task. This improves the granularity of permission configuration for enterprise intelligent applications, enhances the permission adaptation capability in complex business scenarios, and improves the permission collaboration and traceability effect in the process of accessing multiple business systems.

[0025] In this embodiment, determining the request feature information corresponding to the permission request includes: Parse the permission request to obtain the agent identification information of the target agent and the task attribute information of the target task; Based on the task attribute information, determine the target resource information and target business system information involved in the target task; Obtain the task context information corresponding to the permission request, wherein the task context information includes at least one of the following: task initiation object information, request time information, request environment information, and task urgency information; The request feature information is generated based on the agent identification information, the task attribute information, the target resource information, the target business system information, and the task context information.

[0026] In one possible embodiment, the request characteristic information can be obtained by multi-dimensional parsing of the permission request. The permission management platform parses the permission request to obtain the agent identification information of the target agent and the task attribute information of the target task. The agent identification information may include the unique identifier, type identifier, business domain, organization, scope of callable tools, and instance or session identifier of the target agent. The task attribute information may include at least one of the following: task name, task type, task purpose, task flow nodes, task execution actions, and task output requirements. For example, the target task may be reading customer data, generating business reports, submitting approval opinions, modifying business status, calling data interfaces, or deleting temporary files.

[0027] In one possible embodiment, the access control platform determines the target resource information and target business system information involved in the target task based on task attribute information. Target resource information may include business objects, data tables, data fields, files, interfaces, approval documents, customer records, order records, work order records, or other accessible enterprise resources. Target business system information may include the system identifier, system type, interface address, access control model type, resource namespace, or tenant identifier of the business system where the target resource resides. This step clarifies which resources the target agent needs to access when executing the target task and which target business systems these resources belong to.

[0028] In one possible embodiment, the permission management platform obtains the task context information corresponding to the permission request. The task context information may include at least one of the following: task initiator information, request time information, request environment information, and task urgency information. The task initiator information may include the initiating user's user ID, job title, role information, department information, affiliated organization information, and current login status; the request time information may include the date, time period, whether it occurred during working hours, whether it occurred on a holiday, or whether it occurred during peak business hours; the request environment information may include the request source network, terminal device, login location, session state, access method, and security environment status; the task urgency information can be used to characterize whether the target task is a normal task, an urgent task, an emergency task, or a high-priority task.

[0029] In one possible embodiment, the access control platform generates request feature information based on agent identification information, task attribute information, target resource information, target business system information, and task context information. The request feature information can be stored in a structured data format, such as key-value pairs, feature vectors, access request objects, or request descriptions recognizable by the policy engine. The request feature information can simultaneously reflect information such as "who is making the request, which target agent is executing it, what target task is being performed, which target resources are being accessed, which target business systems are involved, and under what contextual conditions it is being executed," providing a unified data foundation for subsequent risk assessment, access scope determination, and audit traceability.

[0030] This embodiment parses permission requests and sequentially obtains agent identification information, task attribute information, target resource information, target business system information, and task context information. This enables the permission management platform to accurately grasp the access objects and execution conditions when the target agent executes the target task, avoiding permission judgments based solely on fixed accounts or single roles. This provides a clear, complete, and manageable input basis for subsequent dynamic authorization, least privilege control, and cross-system permission configuration.

[0031] In this embodiment, determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy includes: Based on the target resource information and the target business system information, determine the resource sensitivity information corresponding to the permission request; Based on the task context information, determine the context risk information corresponding to the permission request; Based on the agent identification information and / or the task initiating object information, obtain historical permission behavior information, and determine behavior risk information based on the historical permission behavior information; Based on the resource sensitivity information, the context risk information, and the behavioral risk information, determine the risk assessment result corresponding to the permission request; Based on the risk assessment results, the authorization processing method corresponding to the target task is determined. The authorization processing method includes at least one of direct authorization, authorization with additional constraints, authorization after approval, or refusal of authorization.

[0032] In one possible embodiment, the access control platform can perform dynamic risk assessment based on request characteristic information and determine the authorization processing method according to the risk assessment results. The access control platform determines the resource sensitivity information corresponding to the access request based on the target resource information and the target business system information. Resource sensitivity information can be determined based on the data type of the target resource, its business importance, whether it contains personal information, financial data, core business data, whether cross-organizational access is allowed, whether batch export is allowed, and the security level of the target business system. For example, customer contact information, financial data, approval workflow opinions, business contracts, employee information, and operating reports can be configured as resources with different sensitivity levels.

[0033] In one possible embodiment, the permission management platform determines the context risk information corresponding to the permission request based on the task context information. Specifically, the permission management platform can determine whether the current permission request is in an abnormal context based on information such as the identity of the task initiator, the request time, the request environment, the urgency of the task, and the access location. For example, in scenarios such as non-working hours, abnormal network environments, unused devices, unused locations, or batch access to highly sensitive resources, the context risk level can be increased; in scenarios such as emergency business processing, authorized user login, trusted device access, or enterprise intranet access, the context risk level can be reduced or maintained according to preset policies.

[0034] In one possible embodiment, the permission management platform obtains historical permission behavior information based on the agent's identification information and / or the task initiating object's information, and determines behavioral risk information based on this historical permission behavior information. Historical permission behavior information may include historical permission request records, historical authorization approval records, historical denial records, historical abnormal access records, resource access frequency, permission usage completion status, whether there is out-of-scope access, whether there is out-of-time access, and historical audit results, etc. The permission management platform can determine whether the current request matches historical normal behavior based on the historical permission behavior information, thereby obtaining behavioral risk information.

[0035] In one possible embodiment, the access control platform determines the risk assessment result corresponding to the access request based on resource sensitivity information, contextual risk information, and behavioral risk information. The risk assessment result can be a risk level, risk score, risk label, or risk handling suggestion. Risk assessment results can be categorized into low risk, medium risk, high risk, and access denied levels, or can be represented by a numerical score. The access control platform can determine the risk assessment result through rule matching, weight calculation, policy engines, or risk models, as long as it can comprehensively judge the risk of the current access request based on resources, context, and historical behavior.

[0036] In one possible embodiment, the access control platform determines the authorization processing method corresponding to the target task based on the risk assessment results. The authorization processing method may include at least one of direct authorization, authorization with additional constraints, authorization after approval, or authorization denial. When the risk assessment result is low, direct authorization may be determined; when the risk assessment result is at a medium level, authorization with additional constraints may be determined, such as shortening the validity period, limiting the number of uses, restricting access fields, or prohibiting exports; when the risk assessment result is high but can still be confirmed by management personnel, authorization after approval may be determined; when the risk assessment result exceeds a security threshold or violates organizational permission boundaries, authorization may be denied.

[0037] This embodiment determines resource sensitivity information, context risk information, and behavioral risk information in sequence, and generates risk assessment results and authorization processing methods accordingly. This enables the permission management platform to fully consider the importance of the target resource, the task execution environment, and historical behavioral characteristics before authorization, thereby improving the adaptability of the permission authorization process to complex business scenarios and reducing the possibility of the target intelligent agent obtaining excessively broad permissions in high-risk scenarios.

[0038] In this embodiment, determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy further includes: Based on the task attribute information, determine the task execution path information required to complete the target task; Based on the task execution path information and preset permission dependencies, determine a set of candidate permissions associated with the target task; Based on the target resource information and the target business system information, the candidate permission set is matched for resource scope and system scope to obtain the task matching permission set; Based on the risk assessment results and the authorization processing method, the task matching permission set is subjected to permission shrinking processing to obtain the target permission set; The authorization decision information is generated based on the target permission set and the authorization processing method.

[0039] In one possible embodiment, when determining authorization decision information, the permission management platform can also generate a target permission set based on the task execution requirements of the target task. The permission management platform determines the task execution path information required to complete the target task based on task attribute information. The task execution path information can be used to characterize the business actions, tool calls, interface calls, data reading, data writing, process submission, or result generation steps required for the target task to proceed from start to finish. For example, the target task of generating a customer service summary may include execution steps such as reading basic customer information, reading service work orders, reading order status, and generating summary text.

[0040] In one possible embodiment, the permission management platform determines a set of candidate permissions associated with the target task based on task execution path information and preset permission dependencies. Preset permission dependencies can be used to describe the dependencies between permissions of different tasks, resources, operations, and business systems. Preset permission dependencies can be implemented using permission dependency graphs, permission dependency tables, permission rule bases, or task permission templates. The set of candidate permissions may include read permissions, write permissions, execute permissions, delete permissions, field access permissions, interface call permissions, process processing permissions, and cross-system access permissions that may be involved in completing the target task.

[0041] In one possible embodiment, the permission management platform performs resource-scope matching and system-scope matching on the candidate permission set based on target resource information and target business system information to obtain a task-matching permission set. Resource-scope matching determines whether permission items in the candidate permission set are consistent with the resource object indicated by the target resource information, while system-scope matching determines whether permission items in the candidate permission set belong to the business system indicated by the target business system information. Through resource-scope matching and system-scope matching, permission items irrelevant to the target resource or target business system can be removed, initially converging the candidate permission set into a task-matching permission set related to the target task.

[0042] In one possible embodiment, the permission management platform performs permission contraction processing on the task-matching permission set based on risk assessment results and authorization processing methods to obtain a target permission set. Permission contraction processing may include removing unnecessary permissions, narrowing the scope of data access, lowering the operation level, restricting field-level access, restricting access periods, shortening permission validity periods, or adding approval conditions. The target permission set is the set of permissions allowed for the target agent to execute the target task, and its permission scope is less than or equal to the task-matching permission set.

[0043] In one possible embodiment, the access control platform generates authorization decision information based on the target access set and the authorization processing method. The authorization decision information may include at least one of the following: whether authorization is allowed, the target access set, authorization constraints, approval requirements, authorization validity period, access revoke conditions, and reasons for refusal. When the authorization processing method is authorization refusal, the authorization decision information may not include the target access set, but may include the reason for refusal and an audit flag; when the authorization processing method is direct authorization, authorization with additional constraints, or authorization after approval, the authorization decision information may include the target access set and the corresponding authorization constraints.

[0044] This embodiment determines the candidate permission set based on task execution path information and preset permission dependencies, and then gradually narrows the permission scope by combining target resource information, target business system information, risk assessment results and authorization processing methods. This can automatically determine the permissions required for the target task and exclude unnecessary permissions, so that the permissions obtained by the target agent are closer to the actual permission range required to complete the target task, thereby improving the problems of overly broad permissions and unclear permission boundaries in traditional permission configuration.

[0045] In this embodiment, the step of shrinking the task matching permission set to obtain the target permission set includes: Determine the operation type, resource object, and data range corresponding to each permission item in the task matching permission set to obtain permission item description information; The permission item description information is matched with the task execution path information to determine the necessary and unnecessary permission items in the task matching permission set; The unnecessary permission items are removed, and the data range of the necessary permission items is limited according to the resource sensitivity information to obtain a shrinking permission set; The target permission set is obtained by configuring at least one of the following in accordance with the authorization processing method: validity period, number of uses, access scenario, and recycling conditions for the shrinking permission set.

[0046] In one possible embodiment, the permission management platform can further refine the task-matching permission set to obtain a target permission set. The permission management platform determines the operation type, resource object, and data scope corresponding to each permission item in the task-matching permission set, obtaining permission item description information. Operation types may include read, write, execute, delete, export, approve, submit, query, call an interface, or update status, etc.; resource objects may include business objects, files, data tables, data fields, interfaces, process nodes, documents, or records; data scope may include accessible fields, accessible record ranges, accessible organizational ranges, accessible time ranges, or accessible data sets.

[0047] In one possible embodiment, the permission management platform matches permission item descriptions with task execution path information to determine necessary and unnecessary permission items in the task-matched permission set. Necessary permission items are those actually used by the target agent in the task execution path to complete the target task; unnecessary permission items are those that exist in the task-matched permission set but do not match the target task's current execution path, target resources, operation type, or data scope. For example, if the target task only needs to read customer service records, permissions such as modifying customer information, deleting work orders, and exporting all customer data can be determined as unnecessary permission items.

[0048] In one possible implementation, the permission management platform removes unnecessary permission items and limits the data scope of necessary permission items based on resource sensitivity information, resulting in a reduced permission set. For resources with high sensitivity levels, the permission management platform can limit necessary permission items to the field level, record level, or interface level. For example, when accessing customer information, reading customer number, order status, and service order summary may be allowed, but reading sensitive fields such as ID number, payment account, and complete contact information may be restricted; when accessing financial statements, reading summary data may be allowed, but reading detailed data or exporting data may be restricted.

[0049] In one possible embodiment, the permission management platform configures at least one of the following for shrinking the permission set: validity period, usage count, access scenario, and eviction conditions, based on the authorization processing method, to obtain the target permission set. The validity period can be used to limit the time interval during which the permission can be used; the usage count can be used to limit the number of times authorization control credentials or access permissions can be invoked; the access scenario can be used to restrict the permission to be used only in a specific network environment, device environment, or task session; eviction conditions can include task completion, task failure, expiration of validity period, approval revocation, change in risk level, or detection of abnormal access, etc. The target permission set includes not only the permission items themselves but also constraints on how the permission items are used.

[0050] This embodiment describes the operation type, resource object, and data scope of permission items and matches them with task execution path information to distinguish between necessary and unnecessary permission items. Then, it configures data scope limitations and usage constraints for necessary permission items. This enables permission contraction at the operation level and field level, allowing the permission scope to converge according to the actual needs of the target task. This better implements least privilege control and reduces the risk that the target agent will obtain permissions beyond what the target task requires.

[0051] In this embodiment, configuring or controlling the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information includes: Based on the authorization decision information, an authorization control credential is generated for configuring or controlling access permissions to the target intelligent agent, wherein the authorization control credential includes the target permission set and the authorization constraints. Based on the target business system information, determine the system permission mapping rules corresponding to the authorization control credential; According to the system permission mapping rules, the authorization control credentials are converted into system permission control information that can be recognized by each target business system; The system access control information is sent to the corresponding target business system to obtain access configuration feedback information; Based on the permission configuration feedback information, the access control status of the target intelligent agent in the corresponding target business system is determined.

[0052] In one possible embodiment, the access control platform can generate authorization control credentials based on authorization decision information and convert these credentials into access control information recognizable by the target business system. The access control platform generates authorization control credentials for configuring or controlling access permissions to the target agent based on the authorization decision information. These credentials can be temporary permission tokens, access tickets, session credentials, policy objects, or authorization data recognizable by the business system gateway. The authorization control credentials may include a target permission set and authorization constraints, and may also include the target agent identifier, target task identifier, target business system identifier, resource scope, operation scope, field scope, validity period, approval status, risk level, and eviction conditions.

[0053] In one possible embodiment, the access control platform determines the system access control mapping rules corresponding to the authorization control credentials based on the target business system information. Since different target business systems may have different access control models—for example, an office automation system might use workflow nodes and approval actions to represent permissions, an enterprise resource management system might use document types and operation permissions, and a customer relationship management system might use customer objects and field permissions—the access control platform can pre-maintain system access control mapping rules between a unified access control model and the local access control models of each target business system. These system access control mapping rules can include access control item code mapping, resource object mapping, field mapping, operation type mapping, role mapping, interface mapping, and constraint mapping, etc.

[0054] In one possible embodiment, the access control platform converts authorization control credentials into system access control information recognizable by each target business system according to system access control mapping rules. This system access control information can include temporary role configurations, API call tokens, access control policies, data filtering conditions, field anonymization rules, process operation permissions, or business system gateway policies within the target business system. Through this conversion process, the uniformly generated authorization control credentials can be recognized and executed by different target business systems, avoiding the need for the target agent to separately apply for and maintain permissions in different systems.

[0055] In one possible embodiment, the permission management platform sends system permission control information to the corresponding target business system and receives permission configuration feedback information. This feedback information may include status information such as configuration success, configuration failure, partial configuration success, permission item not found, resource not found, interface unavailable, policy conflict, or configuration delay. The permission management platform can send system permission control information to the corresponding target business system via API interfaces, message queues, permission synchronization services, policy distribution services, or proxy gateways.

[0056] In one possible embodiment, the access control platform determines the access control status of the target agent in the corresponding target business system based on access configuration feedback information. The access control status can include states such as active, inactive, partially active, configuration failed, awaiting approval, revoked, or expired. The access control platform can associate and store the access control status with the target task to subsequently control whether the target agent can continue to call the corresponding target business system.

[0057] This embodiment generates authorization control credentials and uses system permission mapping rules to convert them into system permission control information that can be recognized by each target business system. This enables permission configuration or control of different target business systems on the basis of unified authorization decision, reduces the management complexity caused by inconsistent permission models of multiple business systems, and improves the permission coordination capability of the target intelligent agent when executing target tasks across systems.

[0058] In this embodiment, when there are multiple target business systems, the method further includes: Summarize the permission configuration feedback information returned by each of the target business systems to obtain the cross-system configuration results; Based on the cross-system configuration results, determine whether the permission configuration status between multiple target business systems meets the preset consistency conditions, and obtain the consistency judgment result. If the consistency judgment result indicates that the preset consistency condition is not met, the target business system and abnormal permission item with the configuration abnormality are determined, and cross-system permission abnormality information is obtained. Based on the cross-system permission exception information, a permission compensation instruction or a permission rollback instruction is generated, and the access permission control status and cross-system permission synchronization status are updated based on the permission compensation instruction or the permission rollback instruction.

[0059] In one possible embodiment, when there are multiple target business systems, the permission management platform can perform consistency management of cross-system permission configuration results. The permission management platform aggregates the permission configuration feedback information returned by each target business system to obtain the cross-system configuration results. These results may include the permission configuration status, active and inactive permissions, reasons for configuration failure, configuration time, system response status, and synchronization version number for each target business system. Through aggregation, the permission management platform can obtain the overall permission configuration status of the target task across multiple target business systems.

[0060] In one possible embodiment, the permission management platform determines whether the permission configuration status of multiple target business systems meets preset consistency conditions based on the cross-system configuration results, thus obtaining a consistency judgment result. Preset consistency conditions may include that all necessary permission items in the target permission set have been successfully configured, the permission scope in each target business system does not exceed the permission scope defined by the authorization decision information, the validity period of permissions in each system is consistent or does not exceed a unified validity period, the cross-system permission status is either all effective or all revoked, and the permission configuration version is consistent. If the permission configuration status of multiple target business systems meets the preset consistency conditions, then the cross-system permission configuration can be considered consistent; if a target business system fails to configure permissions, has an excessively broad permission scope, or has inconsistent permission validity periods, then the preset consistency conditions are not met.

[0061] In one possible embodiment, if the consistency judgment result does not meet the preset consistency conditions, the permission management platform identifies the target business system and the abnormal permission item with the abnormal configuration, thus obtaining cross-system permission anomaly information. This cross-system permission anomaly information may include the abnormal business system identifier, the abnormal permission item, the anomaly type, the anomaly cause, the scope of impact, and handling suggestions. For example, if a target business system fails to configure read permissions, the target task may fail to complete; if a target business system incorrectly configures write permissions, the permission scope may exceed the authorization decision information.

[0062] In one possible embodiment, the permission management platform generates a permission compensation instruction or a permission rollback instruction based on cross-system permission anomaly information, and updates the access control status and cross-system permission synchronization status based on the instruction. The permission compensation instruction can be used to reissue failed system permission control information, correct permission item mapping relationships, or supplement missing permission configurations; the permission rollback instruction can be used to revoke configured but ineffective permissions, reclaim access permissions in some systems, or terminate cross-system access corresponding to a target task. The cross-system permission synchronization status can be used to characterize whether the permission configurations of multiple target business systems have reached consistency, whether they are in the compensation process, whether they have been rolled back, or whether there are any pending anomalies.

[0063] This embodiment aggregates permission configuration feedback information from multiple target business systems and performs consistency judgment based on preset consistency conditions. When cross-system permission anomalies are detected, permission compensation instructions or permission rollback instructions are generated. This can avoid problems such as inconsistent permission configurations, inconsistent permission scopes, or residual permissions in multiple target business systems, thereby improving the stability and security of cross-system permission management.

[0064] In this embodiment, the step of recording the permission request, the authorization decision information, and the usage information of the access permissions to generate permission audit information corresponding to the target task includes: Collect the request records corresponding to the permission requests, the decision records corresponding to the authorization decision information, the configuration records of the access permissions, and the invocation records of the access permissions to obtain a set of permission events; Determine the task identifier information corresponding to the target task, and associate each permission event in the permission event set according to the task identifier information to obtain the task permission event chain; Based on the task permission event chain, detect whether the target intelligent agent has access beyond the scope, access beyond the time limit, access with abnormal frequency, or cross-system abnormal access, and obtain the permission usage detection result. Based on the task permission event chain and the permission usage detection results, the permission audit information is generated.

[0065] In one possible embodiment, the permission management platform can generate permission audit information around the target task. The permission management platform collects request records corresponding to permission requests, decision records corresponding to authorization decision information, access permission configuration records, and access permission call records to obtain a set of permission events. Request records may include the permission request initiation time, target agent identifier, task initiation object, target task, target resource, and target business system; decision records may include risk assessment results, authorization processing method, target permission set, authorization constraints, approval status, and rejection reason; configuration records may include system permission control information, permission configuration feedback information, access permission control status, and cross-system permission synchronization status; call records may include the actual access time of the target agent to the target business system, access interface, access resources, operation type, data range, call result, and error information.

[0066] In one possible embodiment, the permission management platform determines the task identifier information corresponding to the target task, and associates each permission event in the permission event set according to the task identifier information to obtain a task permission event chain. The task identifier information can be generated when a permission request is generated, or it can be provided by the business process system, the task scheduling system, or the target intelligent agent. The permission management platform can associate events such as permission application, authorization decision, permission configuration, permission invocation, permission revocation, and anomaly detection under the same target task according to the time sequence or the business process sequence, thereby forming a task permission event chain.

[0067] In one possible embodiment, the permission management platform detects whether the target agent has engaged in out-of-scope access, out-of-time access, abnormally frequent access, or abnormal cross-system access based on the task permission event chain, and obtains the permission usage detection result. Out-of-scope access can refer to the target agent actually accessing resources, fields, interfaces, or operation types that exceed the permission scope defined by the authorization decision information; out-of-time access can refer to continuing to call the target business system after the authorization validity period has expired; abnormally frequent access can refer to the access frequency exceeding a preset threshold or significantly deviating from historical normal behavior; abnormal cross-system access can refer to the target agent initiating access in a target business system that has not completed cross-system consistency configuration or is unauthorized.

[0068] In one possible embodiment, the access control platform generates access audit information based on the task access event chain and access usage detection results. Access audit information may include a full lifecycle record of access rights, abnormal access records, audit conclusions, responsible parties, target business systems, target resources, handling results, and audit reports. Access audit information can be used for internal security audits, compliance checks, anomaly analysis, accountability tracing, and subsequent risk assessments. The access control platform can also feed back access usage detection results to preset access control policies to improve risk identification capabilities in subsequent identical or similar access requests.

[0069] This embodiment collects request records, decision records, configuration records, and call records to form a task permission event chain, which can fully reflect the process of permission application, granting, use, and revocation. By performing anomaly detection on the task permission event chain, it can promptly detect out-of-scope, out-of-term, abnormal frequency, and abnormal cross-system access, thereby improving the traceability of permission use and the ability to identify anomalies.

[0070] In this embodiment, the method further includes: Based on the permission request or the request feature information, determine the task initiation object information and target resource information corresponding to the target task; Based on the task initiation object information and the target resource information, determine the organizational hierarchy information corresponding to the target task; Based on the organizational hierarchy information, determine the organizational permission boundary information corresponding to the target task; When the target task involves cross-organizational access, cross-organizational authorization conditions are determined based on the organizational permission boundary information to obtain cross-organizational permission control information; Based on the cross-organizational permission control information, the authorization decision information or the access permission control status is adjusted to obtain a permission management result that adapts to the organizational hierarchy.

[0071] In one possible embodiment, the access control platform can adjust the access control results based on the enterprise's organizational hierarchy. The platform determines the task initiator information and target resource information corresponding to the target task based on the access request or request characteristic information. The task initiator information may include user identity, affiliated group, affiliated subsidiary, affiliated department, position, role, and authorization level; the target resource information may include the resource's affiliated organization, resource management department, resource business domain, resource sensitivity level, and resource sharing scope.

[0072] In one possible embodiment, the access control platform determines the organizational hierarchy information corresponding to the target task based on the task initiator information and the target resource information. The organizational hierarchy information can characterize the relationship between the organization to which the task initiator belongs and the organization to which the target resource belongs, such as the same department, different departments within the same subsidiary, a group and its subsidiaries, different subsidiaries, cross-business departments, or external collaborating units. The organizational hierarchy information can also include hierarchical relationships, organizational succession relationships, organizational delegation relationships, and organizational isolation relationships.

[0073] In one possible embodiment, the access control platform determines the organizational access boundary information corresponding to the target task based on organizational hierarchy information. This organizational access boundary information can be used to define data access and operational boundaries between different organizations. For example, a group-level organization can access aggregated data from some subsidiaries, a subsidiary-level organization can access its own business data, and a department-level organization can access its own business data. Stricter authorization conditions can be triggered when accessing resources across subsidiaries, departments, or higher-level organizations. The organizational access boundary information can also be used to determine whether the target resource is allowed to be accessed by the current task initiator or the target agent.

[0074] In one possible embodiment, when the target task involves cross-organizational access, the access control platform determines cross-organizational authorization conditions based on organizational permission boundary information to obtain cross-organizational access control information. Cross-organizational authorization conditions may include approval from both authorizing parties, approval from the superior organization, confirmation of resource ownership by the organization, validity period of delegated authorization, scope of inherited permissions, data anonymization requirements, prohibition of export requirements, or access scope restrictions. Cross-organizational access control information may include whether cross-organizational access is allowed, required approval nodes, the scope of data allowed for access, the types of operations allowed to be performed, and conditions for revoking cross-organizational permissions.

[0075] In one possible embodiment, the access control platform adjusts authorization decision information or access control status based on cross-organizational access control information to obtain access management results adapted to organizational hierarchical relationships. For example, when the target task involves cross-subsidiary access and cross-organizational authorization conditions are not met, the access control platform can adjust the authorization processing method to authorization after approval or denial of authorization; when cross-organizational authorization conditions are met, the access control platform can limit the organizational scope of the target access set, so that the target agent can only access data resources within the authorized organization. If the enterprise's organizational structure changes, the access control platform can also update the organizational access boundary information based on the changed organizational hierarchical relationship information and adjust or revoke the relevant access control status.

[0076] This embodiment determines the task initiation object information, target resource information, organizational hierarchy relationship information, and organizational permission boundary information, and generates cross-organizational permission control information in cross-organizational access scenarios. This enables the permission management results to adapt to multi-level organizational structures such as groups, subsidiaries, and departments, reducing unclear permission boundaries and chaotic permission inheritance issues in cross-organizational access, and improving the isolation and flexibility of agent permission management in enterprise group scenarios.

[0077] In one embodiment, an enterprise-level intelligent agent permission management system is provided, comprising: The request processing module is used to receive permission requests initiated by the target agent for the target task, and determine the request feature information corresponding to the permission request; The authorization decision module is used to determine authorization decision information matching the target task based on the request feature information and the preset permission management strategy. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. The access control module is used to configure or control the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information. The audit traceability module is used to record the permission requests, the authorization decision information, and the usage information of the access permissions, and generate permission audit information corresponding to the target task. The specific implementation details of each module can be found in the above description of the enterprise-level intelligent agent permission management method, and will not be repeated here.

[0078] In one possible embodiment, this application also provides an enterprise-level intelligent agent access control system. This system can be deployed in an enterprise access control platform, an enterprise AI security platform, a unified identity authentication platform, or a business system access gateway. The system includes a request processing module, an authorization decision module, an access control module, and an audit and traceability module. Each module can be implemented through software programs, hardware circuits, cloud service components, containerized services, or a combination thereof. The modules can interact with each other through an internal bus, service interface, message queue, or database.

[0079] In one possible embodiment, the request processing module receives permission requests initiated by the target agent for a target task and determines the request feature information corresponding to the permission request. The request processing module can parse the permission request to obtain agent identification information, task attribute information, target resource information, target business system information, and task context information, and organize this information into request feature information. The request processing module can also perform format validation, identity validation, session validation, and duplicate request filtering on the permission request to ensure the integrity and validity of the data entering the subsequent authorization decision-making process.

[0080] In one possible embodiment, the authorization decision module is used to determine authorization decision information matching the target task based on request feature information and preset permission management policies. The authorization decision module may include a risk assessment unit, a permission set determination unit, a permission contraction unit, and an authorization processing unit. The risk assessment unit is used to determine the risk assessment result based on resource sensitivity information, contextual risk information, and behavioral risk information; the permission set determination unit is used to determine the candidate permission set based on task execution path information and preset permission dependencies; the permission contraction unit is used to eliminate unnecessary permission items and limit the data scope of necessary permission items; the authorization processing unit is used to determine authorization processing methods such as direct authorization, authorization with additional constraints, authorization after approval, or denial of authorization based on the risk assessment result, and generates authorization decision information.

[0081] In one possible embodiment, the access control module is used to configure or control the access permissions of a target agent in at least one target business system based on authorization decision information. The access control module may include an authorization control credential generation unit, a system permission mapping unit, a permission synchronization unit, and a cross-system consistency processing unit. The authorization control credential generation unit generates temporary permission tokens, access tickets, or policy objects; the system permission mapping unit converts the unified authorization result into system permission control information recognizable by each target business system; the permission synchronization unit sends the system permission control information to the corresponding target business system and receives permission configuration feedback information; the cross-system consistency processing unit performs consistency checks on the permission configuration status of multiple target business systems and generates permission compensation instructions or permission rollback instructions in case of anomalies.

[0082] In one possible embodiment, the audit traceability module records permission requests, authorization decision information, and access permission usage information, generating permission audit information corresponding to the target task. The audit traceability module can collect request records, decision records, configuration records, call records, and eviction records, and form a task permission event chain based on task identification information. The audit traceability module can also detect out-of-scope access, out-of-time access, abnormally frequent access, or abnormal cross-system access based on the task permission event chain, and generate permission usage detection results and audit reports. The audit traceability module can also feed back the anomaly detection results to the authorization decision module to update subsequent permission management strategies or improve the accuracy of subsequent risk assessments.

[0083] In one possible embodiment, the enterprise-level intelligent agent access control system can also connect with the enterprise organization management system, identity authentication system, approval system, and various target business systems. The organization management system can provide organizational hierarchy information such as group, subsidiary, and department levels; the identity authentication system can provide task initiation object information and login status; the approval system can execute post-approval authorization processes; and the target business systems can receive system access control information and return access configuration feedback information. Through the collaboration of these systems, unified access control for target intelligent agents can be achieved across multiple enterprise business systems, organizational levels, and task scenarios.

[0084] This embodiment, through the collaborative work of the request processing module, authorization decision module, permission control module, and audit traceability module, can realize permission request parsing, authorization decision generation, cross-business system access permission control, and permission audit traceability at the system level. It can not only support the task execution needs of enterprise intelligent agents, but also reduce the security risks caused by static permission configuration, unified authorization, and cross-system permission fragmentation, thereby improving the refinement, collaboration, and traceability of enterprise-level intelligent agent permission management.

[0085] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. An enterprise-level intelligent agent permission management method, characterized in that, Applied to a permission management platform, the method includes: Receive a permission request initiated by a target agent for a target task, and determine the request feature information corresponding to the permission request; the request feature information includes target business system information involved in the target task; Based on the request feature information and the preset permission management strategy, authorization decision information matching the target task is determined. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. Based on the authorization decision information, the access permissions of the target intelligent agent in at least one target business system are configured or controlled; Record the permission request, the authorization decision information, and the usage information of the access permission, and generate permission audit information corresponding to the target task; The step of configuring or controlling the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information includes: Based on the authorization decision information, an authorization control credential is generated for configuring or controlling access permissions to the target intelligent agent, wherein the authorization control credential includes a target permission set and the authorization constraints. Based on the target business system information, determine the system permission mapping rules corresponding to the authorization control credential; According to the system permission mapping rules, the authorization control credentials are converted into system permission control information that can be recognized by each target business system; The system access control information is sent to the corresponding target business system to obtain access configuration feedback information; Based on the permission configuration feedback information, determine the access control status of the target intelligent agent in the corresponding target business system; When there are multiple target business systems, the method further includes: Summarize the permission configuration feedback information returned by each of the target business systems to obtain the cross-system configuration results; Based on the cross-system configuration results, determine whether the permission configuration status between multiple target business systems meets the preset consistency conditions, and obtain the consistency judgment result. If the consistency judgment result indicates that the preset consistency condition is not met, the target business system and abnormal permission item with the configuration abnormality are determined, and cross-system permission abnormality information is obtained. Based on the cross-system permission exception information, a permission compensation instruction or a permission rollback instruction is generated, and the access permission control status and cross-system permission synchronization status are updated based on the permission compensation instruction or the permission rollback instruction.

2. The enterprise-level intelligent agent permission management method according to claim 1, characterized in that, The step of determining the request feature information corresponding to the permission request includes: Parse the permission request to obtain the agent identification information of the target agent and the task attribute information of the target task; Based on the task attribute information, determine the target resource information and target business system information involved in the target task; Obtain the task context information corresponding to the permission request, wherein the task context information includes at least one of the following: task initiation object information, request time information, request environment information, and task urgency information; The request feature information is generated based on the agent identification information, the task attribute information, the target resource information, the target business system information, and the task context information.

3. The enterprise-level intelligent agent permission management method according to claim 2, characterized in that, The step of determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy includes: Based on the target resource information and the target business system information, determine the resource sensitivity information corresponding to the permission request; Based on the task context information, determine the context risk information corresponding to the permission request; Based on the agent identification information and / or the task initiating object information, obtain historical permission behavior information, and determine behavior risk information based on the historical permission behavior information; Based on the resource sensitivity information, the context risk information, and the behavioral risk information, determine the risk assessment result corresponding to the permission request; Based on the risk assessment results, the authorization processing method corresponding to the target task is determined. The authorization processing method includes at least one of direct authorization, authorization with additional constraints, authorization after approval, or refusal of authorization.

4. The enterprise-level intelligent agent permission management method according to claim 3, characterized in that, The step of determining the authorization decision information matching the target task based on the request feature information and the preset permission management policy further includes: Based on the task attribute information, determine the task execution path information required to complete the target task; Based on the task execution path information and preset permission dependencies, determine a set of candidate permissions associated with the target task; Based on the target resource information and the target business system information, the candidate permission set is matched for resource scope and system scope to obtain the task matching permission set; Based on the risk assessment results and the authorization processing method, the task matching permission set is subjected to permission shrinking processing to obtain the target permission set; The authorization decision information is generated based on the target permission set and the authorization processing method.

5. The enterprise-level intelligent agent permission management method according to claim 4, characterized in that, The step of shrinking the task matching permission set to obtain the target permission set includes: Determine the operation type, resource object, and data range corresponding to each permission item in the task matching permission set to obtain permission item description information; The permission item description information is matched with the task execution path information to determine the necessary and unnecessary permission items in the task matching permission set; The unnecessary permission items are removed, and the data range of the necessary permission items is limited according to the resource sensitivity information to obtain a shrinking permission set; The target permission set is obtained by configuring at least one of the following in accordance with the authorization processing method: validity period, number of uses, access scenario, and recycling conditions for the shrinking permission set.

6. The enterprise-level intelligent agent permission management method according to claim 1, characterized in that, The process of recording the permission request, the authorization decision information, and the usage information of the access permissions to generate permission audit information corresponding to the target task includes: Collect the request records corresponding to the permission requests, the decision records corresponding to the authorization decision information, the configuration records of the access permissions, and the invocation records of the access permissions to obtain a set of permission events; Determine the task identifier information corresponding to the target task, and associate each permission event in the permission event set according to the task identifier information to obtain the task permission event chain; Based on the task permission event chain, detect whether the target intelligent agent has access beyond the scope, access beyond the time limit, access with abnormal frequency, or cross-system abnormal access, and obtain the permission usage detection result. Based on the task permission event chain and the permission usage detection results, the permission audit information is generated.

7. The enterprise-level intelligent agent permission management method according to claim 6, characterized in that, The method further includes: Based on the permission request or the request feature information, determine the task initiation object information and target resource information corresponding to the target task; Based on the task initiation object information and the target resource information, determine the organizational hierarchy information corresponding to the target task; Based on the organizational hierarchy information, determine the organizational permission boundary information corresponding to the target task; When the target task involves cross-organizational access, cross-organizational authorization conditions are determined based on the organizational permission boundary information to obtain cross-organizational permission control information; Based on the cross-organizational permission control information, the authorization decision information or the access permission control status is adjusted to obtain a permission management result that adapts to the organizational hierarchy.

8. An enterprise-level intelligent agent permission management system, characterized in that, include: The request processing module is used to receive permission requests initiated by the target agent for the target task, and determine the request feature information corresponding to the permission request; The request feature information includes information about the target business system involved in the target task; The authorization decision module is used to determine authorization decision information matching the target task based on the request feature information and the preset permission management strategy. The authorization decision information is used to indicate whether the target agent is allowed to execute the target task, and the corresponding permission scope and authorization constraints when the target task is allowed to be executed. The access control module is used to configure or control the access permissions of the target intelligent agent in at least one target business system based on the authorization decision information. The audit traceability module is used to record the permission request, the authorization decision information, and the usage information of the access permission, and generate permission audit information corresponding to the target task; Specifically, the access control module is used to: generate an authorization control credential for configuring or controlling access permissions for the target agent based on the authorization decision information, wherein the authorization control credential includes a target permission set and the authorization constraints; determine the system permission mapping rule corresponding to the authorization control credential based on the target business system information; convert the authorization control credential into system permission control information recognizable by each target business system based on the system permission mapping rule; send the system permission control information to the corresponding target business system to obtain permission configuration feedback information; and determine the access permission control status of the target agent in the corresponding target business system based on the permission configuration feedback information. When there are multiple target business systems, the access control module is further configured to: aggregate the access configuration feedback information returned by each target business system to obtain cross-system configuration results; determine whether the access configuration status among multiple target business systems meets preset consistency conditions based on the cross-system configuration results to obtain a consistency judgment result; if the consistency judgment result indicates that the preset consistency conditions are not met, identify the target business system with abnormal configuration and the abnormal access permission item to obtain cross-system access permission abnormal information; generate an access compensation instruction or an access rollback instruction based on the cross-system access permission abnormal information, and update the access control status and cross-system access permission synchronization status based on the access compensation instruction or the access rollback instruction.

Images