A file system AI visibility permission control method and system

Abstract

This invention discloses a file system AI visibility permission control method and system, relating to the fields of human-computer interaction and artificial intelligence application security technology. It includes receiving direct operation events from users on the overlay layer or its corresponding icon area; responding to the direct operation events, modifying the AI ​​agent access permission policy for the corresponding file object; and triggering the overlay layer of the file object icon to re-render according to the updated permission policy. This invention continuously overlays personalized character icons representing AI agents onto the base icon of each file or directory object in the file management interface, encoding and reflecting the AI ​​access permission policy of the file object in real time with the display state of the overlay layer. This invention achieves fine-grained control, continuous visibility awareness, and in-situ modification of AI agent file access permissions; what the user sees is the current permission status, what they touch can change, and what they set is immediately executed.

Description

Technical Field

[0001] This invention relates to the field of human-computer interaction and artificial intelligence application security technology, specifically to a file system AI visibility permission control method and system. Background Technology

[0002] With the rapid development of large language models and artificial intelligence agent (AI agent) technologies, AI agents are being integrated into desktop applications at the operating system level, enabling them to read and process various file types, including documents, images, audio, and video, from the local file system. How to allow users to effectively manage the access permissions of AI agents to local files is a significant challenge in the field of AI and human-computer interaction security.

[0003] Existing AI-based file access permission management technologies mainly employ the following methods:

[0004] Method 1: Centralized Permission Settings Panel. Users must access the system settings or application settings interface and configure AI access permissions for files or directories through a dedicated permission management page. Examples include AI assistant products like Microsoft Copilot and ChatGPT. The drawback of this method is that the permission status is hidden deep within the settings panel. Users cannot immediately perceive which files are visible to the AI ​​during daily file operations, leading most users to abandon permission management or choose full authorization, rendering permission management ineffective.

[0005] Method 2: One-time full authorization pop-up. A permission request dialog box appears when the user uses the AI ​​function for the first time, requesting access to a specific directory. The user chooses to allow or deny. The disadvantages of this method are: coarse-grained permissions, only allowing a choice between full permission and full denial, failing to achieve fine-grained control at the directory or file level; and users often lack sufficient judgment when faced with technical permission descriptions, generally tending to allow all permissions.

[0006] Method 3: Real-time Hardware Usage Status Indicator. Similar to the orange / green dots introduced in Apple's iOS 14 system status bar, these indicators display the corresponding color when an app is using the microphone or camera, alerting the user that hardware resources are being used. This method indicates the current hardware resource usage status, not file access permission policies; it applies to hardware sensors, not file objects; and the indicator is read-only, meaning users cannot modify permission policies by interacting with it.

[0007] Method 4: File Synchronization Status Overlay Icons. Cloud storage services such as Dropbox and OneDrive use the Windows Shell extension mechanism (IShellIconOverlayIdentifier interface) to overlay small icons on file / folder icons in File Explorer to indicate the file's cloud synchronization status (e.g., synchronized, synchronizing, error, etc.). The overlay icon in this method represents the synchronization operation status between the file and the cloud storage service, and is unrelated to the AI ​​Agent's access permissions; the overlay icon is a general status symbol, not a visual representation of the AI ​​entity itself; users cannot modify any permissions or policies by directly manipulating the overlay icon.

[0008] Based on the above-mentioned existing technologies, the following fundamental defects exist:

[0009] Fundamental Deficiency 1 (Lack of a New Technology): All existing permission management solutions mentioned above focus on human users or the usage of hardware sensor resources by general applications. None of them address the entirely new permission management scenario arising from the rise of large-scale modeling technology, where AI agents act as access subjects. With AI agents being deeply integrated into operating system-level desktop applications, continuous, batch, and automated access to users' private file data by AI agents has become an objective reality. Existing permission management technologies lack directly applicable solutions for this, constituting a clear technological gap.

[0010] The second fundamental flaw (granularity failure): In the limited practice of AI file access permission management, existing solutions generally fall into two extremes: full permission (one-click authorization pop-up, global switch enable) causes users to lose substantial control over the scope of AI data access; full denial or sequential real-time approval causes AI functions to malfunction or imposes an excessive burden on users. The structural failure of permission granularity renders data security management a mere formality in practice.

[0011] The third fundamental flaw (invisible status and fragmented operation): Users cannot perceive the visibility status of each file to AI during daily file management; permission settings are separated from file operation processes, requiring access to a separate settings interface; users lack an overall understanding of the scope of AI data and are unable to effectively judge and control AI's data access behavior. Summary of the Invention

[0012] This invention aims to fill the technological gap in the novel permission scenario where AI agents act as access subjects in file systems. It addresses the technical problem of existing permission management solutions failing to adequately manage AI data security due to granularity, lack of state visibility, and fragmented operational processes. Specifically, the problem includes: First level (scenario definition): Establishing an independent and complete technical management framework for AI agents' access permissions to users' private file data, distinguishing it from existing file permission management technologies designed for human access subjects, and adapting to the new access characteristics of continuous, batch, and automated file access by AI agents; Second level (granularity issue): Implementing file object-level access control in the AI ​​agent file access permission scenario. Fine-grained access control supports independent configuration of AI access policies for individual files, directories, or any level of directory trees, eliminating the extremes of full allowance and full denial and the resulting substantial failure in access management. Simultaneously, a hierarchical inheritance mechanism reduces the operational cost of fine-grained control to an acceptable level. The third layer (visibility and operability) ensures that the granular control status of AI access permissions is continuously visible and intuitively understandable in the file management interface, allowing users to modify permission policies in-situ within the native file browsing workflow without leaving the current working context and navigating to an independent settings interface. Furthermore, a file system AI visibility access control method and system are proposed, using an AI agent character icon overlay. This method and system renders the personalized character icon of the AI ​​agent overlaid on file system object icons, using the display status of this overlaid icon to represent and control the AI ​​agent's access permissions to the corresponding file objects.

[0013] The objective of this invention can be achieved through the following technical solutions:

[0014] In a first aspect, the present invention provides a file system AI visibility permission control method, comprising the following steps:

[0015] Step S1: Render the file object or directory object in the file management interface. The rendering includes a composite icon containing a basic icon and an overlay layer. The overlay layer contains visual elements representing a personified character of the AI ​​agent. The display state of the overlay layer maps to and reflects the AI ​​agent access permission policy currently in effect for the file object. The display of the overlay layer indicates that the AI ​​agent has access permission to the file object, while the absence of the overlay layer or its negative visual state indicates that the AI ​​agent does not have access permission to the file object.

[0016] Step S2: Receive a direct operation event from the user on the overlay layer or its corresponding icon area; in response to the direct operation event, modify the AI ​​proxy access permission policy of the corresponding file object; trigger the overlay layer of the file object icon to re-render according to the updated permission policy;

[0017] Step S3: When the access permission policy of the AI ​​agent of the directory object changes, the permission policy is propagated to the sub-file objects and sub-directory objects of the directory object through the hierarchical inheritance mechanism; at the same time, the individual permission policy coverage status of the sub-object is maintained, so that the independent permission policy of the sub-object takes precedence over the policy inherited from the parent directory.

[0018] Step S4: Receive an access request from the AI ​​agent to a file object in the file system; query the currently effective AI agent access permission policy for the file object; allow or deny the access request according to the policy; record the access request and processing result in the access log.

[0019] Secondly, this invention provides a file system AI visibility permission control system, comprising:

[0020] The icon overlay rendering module is used to render file objects or directory objects in the file management interface. The rendering includes a composite icon containing a basic icon and an overlay layer. The overlay layer contains visual elements representing a personified character image of an artificial intelligence agent. The display state of the overlay layer maps to and reflects the current active artificial intelligence agent access permission policy of the file object. The display of the overlay layer indicates that the artificial intelligence agent has access permission to the file object, while the absence of the overlay layer or its negative visual state indicates that the artificial intelligence agent does not have access permission to the file object.

[0021] The direct operation interface module is used to receive direct operation events from the user on the overlay layer or its corresponding icon area; in response to the direct operation event, it modifies the AI ​​proxy access permission policy of the corresponding file object and triggers the icon overlay rendering module to re-render the icon of the corresponding file object; wherein the processing of the operation event does not require the user to navigate to a separate permission configuration interface;

[0022] The hierarchical permission inheritance engine is used to maintain the storage and retrieval of AI proxy access permission policies for each file object; when the policy of a directory object changes, the policy is propagated to child objects through the hierarchical inheritance mechanism; and the individual permission policy coverage status of child objects is maintained, so that the independent policy of a child object takes precedence over the inherited policy.

[0023] An access control interceptor is used to receive access requests from AI agents to file objects in the file system; call the hierarchical permission inheritance engine to query the currently effective AI agent access permission policy for the file object; allow or deny the access request according to the policy; and record the access request and processing result to the access log.

[0024] Compared with the prior art, the beneficial effects of the present invention are:

[0025] 1. Filling the Gap in AI Access Subject Permission Management Technology: This invention is the first management method and system specifically designed for the novel permission scenario where AI agents act as file access subjects. Existing file permission management technologies (including operating system access control lists, application authorization pop-ups, hardware occupancy status indicators, and file synchronization status badges) are all designed with human users as the access subjects and do not include the ability to perceive, set, and enforce file access permissions for AI agents; this invention provides a complete technical solution for this scenario.

[0026] 2. Achieving fine-grained AI access control at the file level with acceptable operational costs: Existing AI access authorization schemes only allow a choice between full permission and full denial, or require users to approve each AI access request in real time (an extremely heavy operational burden). This invention achieves fine-grained policy configuration at the file object level through a hierarchical inheritance mechanism: a single configuration operation by a user on a directory can cascade over all child objects under that directory tree, and child objects can also support independent policy overriding; with optimal operation count, it achieves fine-grained AI access permission management for file sets of any size, completely eliminating the contradiction between permission granularity and operational costs.

[0027] 3. Permission status and file objects are continuously visible at zero distance: Compared with the existing solution of hiding the permission status in the settings panel, the present invention encodes the AI ​​access permission policy directly on the file object icon as an overlay layer. During normal file browsing, users can perceive the visibility status of each file to AI in real time. The cost of permission perception is reduced to zero, and the user's cognition of the AI ​​data vision boundary can be continuously and completely maintained.

[0028] 4. In-situ permission modification eliminates workflow disruptions: Compared to existing solutions that require entering a separate settings interface to modify permissions, this invention allows users to instantly modify the AI ​​access policy of the corresponding file by directly manipulating the overlay layer on the file icon (click or right-click menu). Permission modification operations and file management operations are completed in the same operation context, and the workflow is completely continuous.

[0029] 5. Zero-learning-cost semantic encoding based on cognitive intuition: The presence and absence of AI agent character icons directly map to whether AI can access or not, which is consistent with the human's daily cognitive intuition about whether an entity can see something. Users can accurately judge and operate permission policies without understanding any technical permission concepts.

[0030] 6. Complete auditability of AI access behavior: The access control interceptor records every file access request and processing result of the AI ​​agent to the access log, supporting post-event query, verification and compliance audit of AI data access behavior. Attached Figure Description

[0031] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0032] Figure 1 This is a schematic diagram of the overall architecture of the AI ​​visibility permission control system of the present invention;

[0033] Figure 2 This is a schematic diagram illustrating the four display states of the file object icon overlay layer according to the present invention;

[0034] Figure 3 This is a schematic diagram of the hierarchical permission inheritance relationship of the present invention;

[0035] Figure 4 This is a sequence diagram of the interaction between user permission modification and AI agent access control in this invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] The terms "comprising" and "having," and any variations thereof, used in the embodiments of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0038] To facilitate understanding of this embodiment, a detailed description of a file system AI visibility permission control system based on the overlay of AI agent character image icons, as disclosed in this embodiment of the invention, will be provided first.

[0039] Example 1:

[0040] like Figure 1 As shown, a file system AI visibility permission control system includes: an icon overlay rendering module, a direct operation interface module, a hierarchical permission inheritance engine, and an access control interceptor.

[0041] Users trigger operation events through the file management interface. The direct operation interface module receives the events and calls the permission write interface of the hierarchical permission inheritance engine to persistently store the new permission policy. At the same time, the notification icon overlay rendering module refreshes the icon display of the corresponding file object. When the AI ​​agent issues a file access request, the access control interceptor calls the permission query interface of the hierarchical permission inheritance engine, decides to allow or deny the access request based on the returned permission policy, and records the access log.

[0042] The icon overlay rendering module renders each file or directory object in the file management interface. The specific process is as follows:

[0043] S101: Call the permission query interface of the hierarchical permission inheritance engine to obtain the AI ​​access permission policy value that is in effect for the current file object, including allow, prohibit, and inherit;

[0044] S102: Using the obtained basic file type icons as the base layer, determine the content of the overlay layer based on the permission policy value:

[0045] When the policy allows: An AI character icon is overlaid in the upper right corner of the base icon. The AI ​​character icon is a personified visual representation of the AI ​​entity. In this embodiment, it is a cartoon image of a pony in a crouching posture. The icon size is 25% to 35% of the base icon.

[0046] When the policy is prohibited: Do not render the overlay layer, or render a grayed-out prohibited variant of the AI ​​character icon in the upper right corner of the base icon, specifically: reduce the transparency to 30% and overlay a prohibited circle symbol;

[0047] When the strategy is inheritance: recursively query the parent directory strategy in the direction of inheritance, and render the overlay layer with the final allowed / disallowed strategy value.

[0048] S103: Render the synthesized composite icon to the corresponding icon position in the file management interface.

[0049] The direct operation interface module is used to handle user operation events, which include: click on overlay layer events, right-click shortcut menu events, drag and drop to AI input area events, and batch operation events.

[0050] Specifically: Click on the overlay layer event: When a user clicks on the overlay layer area in the upper right corner of the file icon, it triggers a switch in the current file object's AI access permission policy. If the current policy is allowed, it switches to prohibited; if the current policy is prohibited or inherited prohibited, it switches to independent allowed. After switching, the new policy is persistently stored, and the icon overlay rendering module is notified to refresh the icon.

[0051] Right-click context menu event: When a user right-clicks the file object icon, inject the following AI visibility-related options into the pop-up context menu:

[0052] Allow AI to view: Set the current file object policy to Allow;

[0053] Disable AI viewing: Set the current file object policy to disabled;

[0054] Follow folder settings: Clears the independent policy for the current file object and restores the policy of inheriting the parent directory;

[0055] View AI access history: Displays the AI's historical access logs for the file.

[0056] Drag-and-drop to AI input area event: When a user drags a file object with a prohibited policy to the AI ​​input area, a non-interrupted temporary authorization prompt is triggered, providing three options: Allow only this time, Permanently allow, and Cancel drag. If Allow only this time is selected, the file is temporarily granted AI visibility permission for the current AI dialogue session, which is automatically revoked after the session ends; if Permanently allow is selected, the policy is permanently changed to allow.

[0057] Batch operation events: When a user selects multiple file objects and performs an AI visibility operation, the permission settings are applied uniformly to all selected file objects. When setting permissions for a directory object, the user is prompted whether to cascade the application to child objects.

[0058] The hierarchical permission inheritance engine is used to maintain permission policies and storage, and provides permission query and write interfaces; permission policies are persistently stored in the configuration storage medium in a structured format, which includes, but is not limited to, JSON, YAML, XML or database records.

[0059] For example, a local file can be stored in the path `%APPDATA%\AIAgent\visibility.json`. Alternatively, it can be stored in an embedded database or synchronized with the account in the cloud. An example format is shown below.

[0060] {

[0061] "version": "1.0",

[0062] "default_policy": "allow",

[0063] "overrides": {

[0064] "D:\\Private Diary\\": "deny",

[0065] "D:\\Private Diary\\2025 Annual Summary.md": "allow",

[0066] "D:\\Photos\\Family\\": "deny"

[0067] }

[0068] }

[0069] Here, `default_policy` is the default policy for the root directory; `overrides` are paths with independent configurations and their policy values.

[0070] The algorithm for permission query is as follows:

[0071] Input: Path to the target file `P`;

[0072] S201: Check if there is an exact match for path P in `overrides`. If so, return the corresponding strategy value.

[0073] S202: If no exact match is found, take the parent path upwards level by level (remove the part after the last path separator) and repeat step S201;

[0074] S203: If no match is found in `overrides` along the path up to the root path, return the value of `default_policy`.

[0075] Access control interceptors are used to inject interception logic into the AI ​​Agent's file read API call layer, performing the following processing on each file access request:

[0076] S301: Get the absolute path of the accessed file;

[0077] S302: Call the hierarchical permission inheritance engine to query the currently effective AI access permission policy for this path;

[0078] S303: If the policy is allowed, the file access request is permitted, and the AI ​​Agent can obtain the file content normally;

[0079] S304: If the policy is to deny, intercept the file access request and return a permission denial response to the AI ​​Agent; Example: The file path is not within the AI's visibility range, and access has been blocked;

[0080] S305: Append the access request (timestamp, file path, AI agent identifier), permission policy value, and processing result (allow / deny) to the access log file.

[0081] Example 2:

[0082] A file system AI visibility permission control system also includes an AI character overlay layer. This AI character overlay layer supports multiple visual states to provide users with richer permission semantic information, specifically:

[0083] State 1: Active Allow

[0084] The overlay layer displays the complete AI character icon with normal saturation and a prone, gazing posture (indicating the AI ​​is paying attention to this file). This is suitable for file objects that the user has explicitly set as allowed.

[0085] State 2: Inherited Allow

[0086] The overlay layer displays AI character icons, which are 20% smaller than those in the active allowed state, and includes an inheritance marker (such as a small arrow in the lower right corner of the icon) indicating that the current strategy is inherited from the parent directory.

[0087] State 3: Active Deny

[0088] The overlay layer displays a grayscale variant of the AI ​​character icon, with overall transparency reduced to 30%, and a prohibition symbol with a circle and slash overlaid around the icon. This is suitable for file objects that the user has explicitly set to be prohibited.

[0089] State 4: Inherited Deny

[0090] No overlay layers are displayed (the top right corner of the file icon is empty), which is a simple way to indicate that the AI ​​cannot see the file. This is the most common visual state where the AI ​​cannot see the file.

[0091] Users can switch the level of visual detail in the system settings: Concise mode (distinguishing between 'with horse' and 'without horse') or Detailed mode (distinguishing between the four states mentioned above).

[0092] Example 3

[0093] A file system AI visibility permission control system also includes an AI vision overview panel, which is integrated into the AI ​​agent settings interface.

[0094] The AI ​​Vision Overview panel displays all directories and files currently configured with AI visibility permissions in a path tree diagram format, and marks the source of permissions for each node (independent setting / inheritance). This allows users to centrally view and modify the AI ​​visibility permission policies for all paths through the overview panel without entering the file management interface, and the modification results are synchronized to the icon rendering in the file management interface in real time.

[0095] The AI ​​Vision Overview panel also features quick search, permission type filtering, and access log viewing. Quick search allows users to input path keywords to quickly locate the AI ​​visibility settings for a specific file / directory. Permission type filtering displays lists of paths visible only to AI or not visible only to AI. Access log viewing embeds a historical file access log view within the overview panel, showing the most recent N AI file access records (time, path, and operation results), allowing users to verify the consistency between the actual access scope of AI and the configured permissions.

[0096] Figure 1 This is a system architecture diagram of the present invention, showing four functional modules and their data flow. Specifically: Top center: File management interface box, containing file object icons; Bottom left: Icon overlay rendering module box; Bottom right: Direct operation interface module box; Bottom center: Hierarchical permission inheritance engine box, connected to the permission configuration storage medium database symbol below; Rightmost: Access control interceptor box, connected to the AI ​​Agent box and access log database symbol on the right.

[0097] File Management Interface → (Rendering Request) → Icon Overlay Rendering Module (Two-way);

[0098] File Management Interface → (Operation Events) → Direct Operation Interface Module (One-Way);

[0099] Icon overlay rendering module → (Permission query) → Hierarchical permission inheritance engine (two-way);

[0100] Directly manipulate the interface module → (permission writing / notification rendering) → hierarchical permission inheritance engine (one-way);

[0101] Directly manipulate the interface module → (trigger re-rendering) → icon overlay rendering module (one-way);

[0102] Hierarchical permission inheritance engine → (read / write) → permission configuration storage (bidirectional);

[0103] AI Agent → (Access Request) → Access Control Interceptor (One-way);

[0104] Access control interceptor → (permission query) → hierarchical permission inheritance engine (two-way);

[0105] Access control interceptor → (allow / deny response) → AI Agent (one-way);

[0106] Access control interceptor → (write) → access log (one-way).

[0107] Figure 2This is a diagram illustrating the AI ​​visibility states in the file management interface, showing a comparison of the icon appearances for different AI visibility states. The diagram includes the following elements:

[0108] First row: Folder icons showing allowed status (with an AI character overlay layer in the upper right corner), labeled "AI visible - Independently allowed" below the icon;

[0109] The second row shows file icons indicating inheritance permission status (with a small AI character overlay layer in the upper right corner and an inheritance indicator), and the AI ​​is visible below the icon - inherited from the parent folder;

[0110] The third row displays folder icons in a prohibited state (without overlay layers), with a note below the icon indicating "AI Invisible - Independently Prohibited";

[0111] The fourth line displays file icons that are in an inheritance-prohibited state (without overlay layers), with a note below the icon indicating that it is not visible in AI and is inherited from the parent folder;

[0112] The fifth line: A parent folder (with overlay layers, allowed) contains multiple child files (all with overlay layers, inheritance allowed), one of which has no overlay layer (independent is prohibited), and another child file has an overlay layer (independent is allowed but with an overlay indicator), to demonstrate the scenario of cascading inheritance and child overlaying parent.

[0113] Figure 3 This is a hierarchical permission inheritance diagram, which is a tree diagram showing the propagation rules of permission policies in the directory tree.

[0114] Tree structure (from top to bottom):

[0115] [Root directory - Allowed by default] (with a small horse icon)

[0116] │

[0117] ├── [Work Folder / - Inheritance Allowed] (with a small horse icon indicating inheritance ↓)

[0118] │ ├── [Meeting Minutes / - Inheritance Allowed] (with a pony icon indicating inheritance ↓)

[0119] │ │ └── [2024Q1.docx - Inheritance Allowed] (Inheritance is indicated by a small horse icon ↓)

[0120] │ └── [Quarterly Report.xlsx - Inheritance Allowed] (with a pony icon indicating inheritance ↓)

[0121] │

[0122] └── [Private Diary / - Independent Settings Prohibited] (No pony icon, marked as independent settings) (Use bold borders to indicate)

[0123] ├── [Diary 2024.md - Inheritance Prohibited] (No Pony icon, inheritance is marked ↓)

[0124] └── [Annual Summary.md - Independent Allowed] (Contains a pony icon, child elements are marked to overlap parent elements ↑, and marked with bold borders and different styles)

[0125] The illustration on the right side of the image shows: thick border = independent setting, thin border = inherited state; horse icon = visible to AI, empty = invisible to AI; inheritance ↓ arrow = strategy comes from parent.

[0126] Figure 4 This is a sequence diagram of the permission switching interaction process; it shows the complete interaction process of a user preventing AI from viewing a certain file. At the top of the sequence diagram, it includes, in sequence: user, file management interface, direct operation interface module, hierarchical permission inheritance engine, permission configuration storage, and icon overlay rendering module.

[0127] Message sequence:

[0128] User → File Management Interface: Right-click the file icon;

[0129] File Management Interface → User: Display shortcut menu (including option to disable AI viewing);

[0130] User → File Management Interface: Click "Disable AI Viewing";

[0131] File Management Interface → Direct Operation Interface Module: Pass Operation Event (Target Path, Operation Type = Prohibited);

[0132] Directly manipulate the interface module → hierarchical permission inheritance engine: call the write permission policy interface (path P, policy=deny);

[0133] Hierarchical permission inheritance engine → Permission configuration storage: Write overwrite record {P:"deny"};

[0134] Permission configuration storage → Hierarchical permission inheritance engine: Confirmation of successful write;

[0135] Hierarchical permission inheritance engine → Direct operation interface module: Operation successful;

[0136] Directly manipulate the interface module → icon overlay rendering module: notify to refresh the icon of path P;

[0137] Icon overlay rendering module → Hierarchical permission inheritance engine: Query the currently effective policy for path P;

[0138] Hierarchical permission inheritance engine → Icon overlay rendering module: Return policy = deny;

[0139] Icon overlay rendering module → File management interface: Update the icon of file P (remove the AI ​​character overlay layer);

[0140] File Management Interface → User: Displays updated file icons (without overlay layers).

[0141] Example 4

[0142] This invention also provides a file system AI visibility permission control method, which includes the following steps:

[0143] Step S1: For file objects or directory objects in the file management interface, render a composite icon that includes a basic icon and an overlay layer; the overlay layer contains visual elements representing a personified character image of an artificial intelligence agent, and the display state of the overlay layer maps to and reflects the current active artificial intelligence agent access permission policy of the file object;

[0144] Step S2: Receive direct operation events from the user on the overlay layer or its icon area; in response to the direct operation events, modify the AI ​​proxy access permission policy of the corresponding file object and trigger the overlay layer of the file object icon to be re-rendered without requiring the user to navigate to a separate permission configuration interface.

[0145] Step S3: When the access permission policy of the AI ​​agent of the directory object changes, the policy is propagated to the sub-file objects and sub-directory objects of the directory object through the hierarchical inheritance mechanism. At the same time, the individual permission coverage status of the sub-objects is maintained, allowing the independent permission configuration of the sub-objects to take precedence over the parent directory policy.

[0146] Step S4: When the AI ​​agent issues a request to access a file object in the file system, query the AI ​​agent access permission policy currently in effect for the file object, allow or deny the access request according to the policy, and record the access request and processing result in the access log.

[0147] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A file system AI visibility permission control method, characterized in that, Includes the following steps: Step S1: Render the file object or directory object in the file management interface. The rendering includes a composite icon containing a basic icon and an overlay layer. The overlay layer contains visual elements representing a personified character of the AI ​​agent. The display state of the overlay layer maps to and reflects the AI ​​agent access permission policy currently in effect for the file object. The display of the overlay layer indicates that the AI ​​agent has access permission to the file object, while the absence of the overlay layer or its negative visual state indicates that the AI ​​agent does not have access permission to the file object. Step S2: Receive a direct operation event from the user on the overlay layer or its corresponding icon area; in response to the direct operation event, modify the AI ​​proxy access permission policy of the corresponding file object; trigger the overlay layer of the file object icon to re-render according to the updated permission policy; Step S3: When the access permission policy of the AI ​​agent of the directory object changes, the permission policy is propagated to the sub-file objects and sub-directory objects of the directory object through the hierarchical inheritance mechanism; at the same time, the individual permission policy coverage status of the sub-object is maintained, so that the independent permission policy of the sub-object takes precedence over the policy inherited from the parent directory. Step S4: Receive access requests from the AI ​​agent to file objects in the file system; query the currently active AI agent access permission policy for the file objects; Allow or deny the access request according to the policy; record the access request and processing result in the access log.

2. The method according to claim 1, characterized in that, In step S2, the processing of the direct operation event does not require the user to navigate to a separate permission configuration interface; the direct operation event includes at least one of the following: the user clicks on the overlay layer to trigger a permission state switch; Users can select permission settings options through the shortcut menu; Temporary authorization request processing triggered when a user drags and drops the file object into the AI ​​agent input area.

3. The method according to claim 2, characterized in that, When a user drags a file object with a prohibited access policy to the AI ​​agent input area, the method further includes: prompting the user to choose between temporary or permanent authorization; in response to the temporary authorization selection, granting the file object temporary access permission during the current AI agent session, and automatically reverting to the prohibited policy after the session ends.

4. The method according to claim 1, characterized in that, In step S1, the display state of the overlay layer includes at least two of the following: In the first state, the overlay layer is displayed with normal visual attributes, and the corresponding AI agent has independently set permission permissions for the file object. In the second state, the overlay layer is not displayed, corresponding to the AI ​​agent not having access rights to the file object.

5. The method according to claim 4, characterized in that, The display state of the overlay layer also includes: In the third state, the overlay layer is displayed with visual attributes different from those in the first state, corresponding to the AI ​​agent having permission permissions for the file object inherited from the parent directory. In the fourth state, the overlay layer is displayed with an appearance that includes negative visual elements, corresponding to the AI ​​agent having independently set prohibition permissions for the file object. The negative visual elements include reduced transparency and / or overlay of prohibition symbols.

6. The method according to claim 1, characterized in that, Step S3 also includes: When setting permission policies for a directory object in batches, prompt the user to confirm whether the policy is cascaded to the sub-objects of the directory object; and support batch execution of permission policy modifications for multiple selected file objects.

7. The method according to claim 1, characterized in that, The AI ​​agent access permission policy is persistently stored in the configuration storage medium, which includes local structured files, embedded databases, account cloud synchronization storage, or any combination thereof. The configuration storage medium only records file paths with independent policy configurations and their corresponding policy values. For file paths not recorded in the configuration storage medium, the current effective policy is determined by querying the policy configurations of the parent paths level by level up along the directory tree. When there are no records for any parent paths, the default policy value takes effect.

8. The method according to claim 1, characterized in that, The method further includes: An AI agent visibility overview panel is provided, which displays the AI ​​agent visibility permission policies and their sources for each file path in a tree diagram format; the overview panel and the icon overlay layer rendering of the file management interface are synchronized in real time.

9. A file system AI visibility permission control system, characterized in that, include: The icon overlay rendering module is used to render file objects or directory objects in the file management interface, rendering composite icons that include basic icons and overlay layers; The direct operation interface module is used to receive direct operation events from the user on the overlay layer or its corresponding icon area; in response to the direct operation event, it modifies the AI ​​proxy access permission policy of the corresponding file object and triggers the icon overlay rendering module to re-render the icon of the corresponding file object; wherein the processing of the operation event does not require the user to navigate to a separate permission configuration interface; The hierarchical permission inheritance engine is used to maintain the storage and retrieval of AI proxy access permission policies for each file object; when the policy of a directory object changes, the policy is propagated to child objects through the hierarchical inheritance mechanism; and the individual permission policy coverage status of child objects is maintained, so that the independent policy of a child object takes precedence over the inherited policy. Access control interceptors are used to receive access requests from AI agents to file objects in the file system; The hierarchical permission inheritance engine is invoked to query the currently effective AI agent access permission policy for the file object; the access request is allowed or denied according to the policy; and the access request and processing result are recorded in the access log.

10. A file system AI visibility permission control system according to claim 9, characterized in that, Also includes: The AI ​​Vision Overview Panel module is used to display the current AI agent visibility permission policy and policy source of each file object to the user in the form of a path tree diagram, and to accept the user's direct modification operation of the permission policy in the overview panel, and to synchronize the modification results to the hierarchical permission inheritance engine and the icon overlay rendering module in real time.

Images