An agent platform permission management method and system based on topology authorization

Abstract

This invention discloses a method and system for intelligent agent platform permission management based on topology authorization, belonging to the field of enterprise-level software permission management technology. The method includes: in a graph database, using workstation-based office space nodes representing enterprise positions as basic units for organizational modeling; connecting the nodes using directed edges to construct a top-down authorization topology; transitively inheriting permissions along the authorization topology; and progressively aggregating business status data upwards along the reverse path of the authorization topology for access by higher-level workstation-based office space nodes. This invention solves the problems of existing permission management models failing to accurately match workstation-based organizational structures, exhibiting delayed and inefficient responses to organizational changes, and lacking real-time conflict detection and the ability to progressively aggregate business data.

Description

Technical Field

[0001] This invention relates to the field of enterprise-level software permission management technology, specifically to a method and system for managing permissions on an intelligent agent platform based on topology authorization. Background Technology

[0002] In building modern enterprise-level artificial intelligence (AI) agent platforms, accurately and efficiently mapping the complex organizational structure of the real world to the digital platform and establishing a matching access control system are the cornerstones for ensuring the platform's stable and secure operation. With the emergence of new concepts such as "workstation-based intelligent agents," access control systems not only need to manage user access to resources, but also need to define organizational structures, reporting relationships, and data flow channels.

[0003] Currently, access control in enterprise information systems is mostly based on the Role-Based Access Control (RBAC) model and its variants. These models, centered on "users" and "roles," have been widely used in traditional IT environments. However, when these traditional models are directly applied to dynamic and complex intelligent agent platforms, their inherent limitations become apparent.

[0004] First, existing models lack the ability to abstract the core organizational unit of "job position." In a workstation-based intelligent agent platform, a job position (such as "senior architect") is a more persistent organizational unit than a specific employee. Its permissions and responsibilities should be bound to the job position, rather than changing frequently with personnel changes. Traditional user-centric models cannot effectively express this "permanent camp, ever-changing soldiers" organizational characteristic, leading to a disconnect between permission management and the actual organizational structure.

[0005] Secondly, existing technologies generally suffer from delays and inefficiencies in their response mechanisms to organizational structure changes. Frequent personnel changes within enterprises (such as onboarding, job transfers, and departmental restructuring) mean that traditional access control systems typically rely on periodic batch synchronization operations for updates. This creates a time lag between the access control status and the actual organizational state, leading to security vulnerabilities. Some solutions using graph databases tend to employ a strategy of completely rebuilding the access control graph when faced with changes. This incurs enormous computational overhead for large organizations and may cause brief service interruptions during the update process.

[0006] Furthermore, with the dynamic adjustment of organizational structures, the risk of permission conflicts also increases. For example, a position may unexpectedly inherit mutually exclusive permissions due to departmental mergers. Existing conflict detection solutions are mostly offline, batch-based analyses, unable to provide real-time warnings and interventions the instant permission changes occur. They are reactive and fail to meet the proactive security requirements of intelligent agent platforms. At the same time, existing permission systems only focus on the static authorization issue of "who can access what," generally lacking the data aggregation mechanisms needed to support upper-level intelligent decision-making. Summary of the Invention

[0007] To address the technical problems mentioned in the background art, such as the inability of existing permission management models to accurately match workstation-based organizational structures, slow and inefficient response to organizational changes, and the lack of real-time conflict detection and hierarchical aggregation capabilities for business data, this invention provides a method and system for permission management of an intelligent agent platform based on topology authorization.

[0008] This invention provides a topology-based authorization method for intelligent agent platform permission management, comprising: modeling an organization in a graph database using workstation-based office space nodes representing enterprise positions as basic units; connecting the workstation-based office space nodes using directed edges representing authorization relationships to construct a top-down authorization topology; transitively inheriting permissions along the directed edges from higher-level workstation-based office space nodes to lower-level workstation-based office space nodes based on the authorization topology; and accumulating business status data along the reverse path of the authorization topology from lower-level workstation-based office space nodes upwards for reading by higher-level workstation-based office space nodes. In this way, this invention not only establishes a persistent permission model bound to positions but also realizes hierarchical inheritance of permissions and reverse aggregation of business data.

[0009] Furthermore, the workstation-based office space node internally includes: an avatar area for managing the identities of the intelligent agents residing at the node, a management area for configuring management strategies, a workstation area for managing workstation entities, and an inspiration area for storing historical decisions. This internal partitioning structure makes the workstation-based office space node a fully functional organizational container, capable of simultaneously carrying identities, strategies, entities, and knowledge, precisely matching the business needs of the intelligent agent platform.

[0010] Optionally, the business status data is a DTV dataset containing data flows, trust links, and value points. This DTV dataset is ultimately aggregated to form an organizational context for top-level decision-making. This ensures that the aggregated data is not merely raw business records, but rather structured information containing value assessments and trust relationships, providing high-quality input for intelligent high-level decision-making.

[0011] In one implementation, the method further includes: establishing a trust link based on the authorization topology, wherein the trust link includes a bidirectional authorization link for uplink data authorization and downlink command authorization, and follows workstation inheritance rules and peer isolation rules; wherein, the workstation inheritance rule refers to the persistent binding of permissions to workstation-based office space nodes, and when the binding relationship between an agent and a node changes, the new agent automatically inherits the permissions of that node; the peer isolation rule refers to the fact that peer nodes at the same level in the authorization topology have no permission granting relationship by default. This solution clarifies the authorization boundaries and interaction rules within the organization, ensuring the orderly and secure flow of data.

[0012] Furthermore, the method also includes updating the authorization topology in response to detecting an organizational structure change event from an external source system. This enables the authorization system to maintain real-time synchronization with authoritative organizational information sources (such as HR systems, where HR stands for Human Resources).

[0013] Specifically, updating the authorization topology includes: starting from the starting node corresponding to the change event, traversing along the authorization topology to locate the affected local subgraph, and recalculating permissions only for nodes within that local subgraph. This incremental update method, compared to full reconstruction, greatly improves the efficiency and performance of the system in responding to organizational changes, and is especially suitable for large and frequently changing organizations.

[0014] Optionally, the monitoring of organizational structure change events from external source systems includes receiving organizational change events from the enterprise HR system via a message queue. This event-driven asynchronous messaging mechanism achieves low coupling and high real-time connectivity between the permission system and external systems.

[0015] Furthermore, the method also includes: immediately triggering online permission conflict detection after the permission recalculation is completed. This step tightly couples conflict detection with the permission change process, realizing a shift from "post-event analysis" to "real-time protection," enabling intervention before potential risks take effect.

[0016] In one implementation, the online permission conflict detection includes detecting at least one of mutually exclusive permission conflicts, permission escalation conflicts, and unauthorized path conflicts; and the method further includes: based on the risk level of the detected permission conflict, adopting a conflict handling strategy of blocking changes, issuing alarms, or automatically disconnecting conflicting paths. By defining a multi-dimensional conflict model and hierarchical processing strategy, the system can more intelligently and flexibly respond to different types of permission risks.

[0017] This invention also provides a topology-based authorization intelligent agent platform permission management system, comprising: a modeling module for performing organizational modeling in a graph database using workstation-based office space nodes representing enterprise positions; a topology construction module for connecting the workstation-based office space nodes using directed edges representing authorization relationships to construct a top-down authorization topology; a permission transfer module for transitively inheriting permissions from upper-level workstation-based office space nodes to lower-level workstation-based office space nodes along the directed edges based on the authorization topology; and a data aggregation module for aggregating business status data from lower-level workstation-based office space nodes upwards along the reverse path of the authorization topology, based on the authorization topology, for reading by upper-level workstation-based office space nodes.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. Achieved precise organizational modeling: By using workstation-based office space nodes as the basic unit, this invention binds permissions to persistent "positions" rather than volatile "personnel," accurately mapping the organizational structure of modern enterprises, supporting seamless switching of intelligent agents between different positions, and solving the problem of mismatch between traditional RBAC models and workstation-based platforms.

[0019] 2. Achieves efficient real-time synchronization and updates: By monitoring external organizational changes through an event-driven mechanism and combining an incremental update algorithm based on graph database adjacency queries, this invention can respond to organizational structure adjustments in milliseconds, and the computational overhead is far lower than that of a full reconstruction scheme, ensuring the real-time performance and high availability of the permission system.

[0020] 3. Proactive online conflict protection: This invention triggers online permission conflict detection immediately after each permission change, and can detect and handle various conflicts such as mutually exclusive permissions and permission escalation in real time according to preset strategies, thus bringing security protection forward and transforming passive risk auditing into proactive risk defense.

[0021] 4. Achieved unique business data aggregation capability: This invention creatively utilizes the reverse path of the authorization topology to establish a channel for the bottom-up aggregation of business status data, which can provide the upper-level decision-making intelligence with a real-time, comprehensive data view with organizational context, filling the gap in the data value chain of existing permission management technologies. Attached Figure Description

[0022] Figure 1 This is a flowchart of the permission management method of the present invention.

[0023] Figure 2 This is a schematic diagram of the internal partitioning structure of a workstation-style office space node.

[0024] Figure 3Flowchart for incremental updates and conflict detection in response to organizational change events.

[0025] Figure 4 This is a block diagram of the permission management system architecture of the present invention.

[0026] Figure 5 This is a schematic diagram of the authorized topology of a preferred embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the specific embodiments of this invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0028] This invention aims to address a series of challenges arising from deficiencies in the organizational structure and permission management mechanisms of existing enterprise-level AI intelligent agent platforms. These challenges include delayed response to organizational structure changes, potential conflicts during dynamic permission adjustments, high computational overhead for permission updates, and a lack of effective hierarchical data aggregation mechanisms. To overcome these shortcomings, this invention proposes a novel permission management framework. Its core idea is to use "workstation-based office space nodes" that accurately map enterprise positions as the basic modeling units in a graph database. By constructing an "authorization topology" representing organizational hierarchy and authorization relationships, automated transitive inheritance of permissions is achieved on this topology. Furthermore, the reverse path of this topology enables hierarchical reverse aggregation of business status data. This design not only enables real-time and efficient maintenance of the organizational structure but also provides a reliable data foundation for upper-level intelligent decision-making.

[0029] To ensure a consistent understanding of the technical solution of this invention, the core terms involved in the solution are first defined. An office workstation node (Office) refers to an organizational unit node in a graph database that represents a specific job position (such as "senior architect") within an enterprise. As a basic container for permissions and data, it is a persistent organizational entity that does not disappear with personnel changes. A directed edge representing an authorization relationship (authorizes) refers to a directed edge in a graph database used to connect different office workstation nodes. Its direction indicates the flow of authorization, typically from a higher-level node to a lower-level node, and this authorization relationship is transitive. The graph structure formed by office workstation nodes and directed edges is the authorization topology, which is usually presented as a tree or directed acyclic graph (DAG) structure, intuitively reflecting the organizational hierarchy and authorization relationships of the enterprise.

[0030] Furthermore, business status data refers to a data set reflecting the business activities and output value of a specific workstation-based office space node. In a specific implementation of this invention, it is represented as a DTV dataset. Trust links are a two-way authorization relationship established based on an authorization topology. This includes not only downward instruction authorization from superiors to subordinates but also upward data authorization from subordinates to superiors, ensuring the secure and orderly flow of data. Finally, organizational context refers to a comprehensive data view formed at the top-level node by aggregating the business status data of lower-level nodes along the reverse path of the authorization topology, reflecting the real-time status of the entire organization and providing data support for top-level decision-makers. The technical solution of this invention will be described in detail below.

[0031] like Figure 1 As shown, this invention provides a topology-based authorization-based intelligent agent platform permission management method, the specific process of which corresponds to the system functions. The first step of this method is to perform organizational modeling, namely, step: organizational modeling using workstation-based office space nodes. In this step, each workstation-based office space node in the graph database not only represents a job position, but also has a finely divided internal structure. For example... Figure 2 As shown, in one specific implementation, each workstation-based office space node can contain four logical partitions to support complex and diverse business needs.

[0032] Specifically, these four partitions include: the Avatar Zone, which manages the identity information of the agents currently stationed on the node. When personnel change roles, only the binding relationship in the Avatar Zone needs to be updated, without modifying the node itself or its permissions, thus achieving persistent binding between permissions and roles; the Management Zone, which stores the node's configuration management policies, such as permission templates and data aggregation rules (DTV configuration), serving as the definition center for node metadata and behavioral rules; the Workstation Zone, which manages one or more specific workstation entities under the role, with each workstation entity binding to a specific agent; and the Inspiration Zone, which stores and consolidates decision records generated by the role in historical work, as well as best practices, knowledge assets, and other data. This four-partition structure makes the workstation-based office space node a fully functional organizational container, precisely matching the "role-workstation-agent" three-level entity architecture of the workstation-based agent platform.

[0033] After completing organizational modeling, the next step in the methodology is to construct the authorization topology, specifically, the top-down authorization topology. In the graph database, directed edges are created from higher-level workstation nodes to lower-level workstation nodes, forming an authorization topology that reflects the organization's reporting relationships. This topology forms the foundation for all subsequent permission operations and data flows. Based on this authorization topology, the system can further establish trust links.

[0034] In a preferred embodiment, establishing a trust link involves defining a two-way authorization link and following specific rules. The two-way authorization link manifests in two ways: firstly, child nodes automatically gain "insight" permissions to their business status data from higher-level nodes, forming an upward data authorization; secondly, parent nodes automatically obtain "instruction issuance" permissions to child nodes, forming a downward instruction authorization. Furthermore, the establishment of the trust link also follows workstation inheritance rules and peer-to-peer isolation rules. Workstation inheritance rules ensure that permissions are persistently bound to workstation-based office space nodes; any agent bound to that node will automatically inherit all its permissions, realizing permission-based access. Peer-to-peer isolation rules guarantee that peer nodes at the same level in the authorization topology are isolated from each other by default and have no permission granting relationship. This protects the information security boundaries between departments or teams unless there is explicit collaborative authorization.

[0035] After the authorization topology is constructed, the method proceeds to the step of transitive inheritance of permissions along the authorization topology. The core mechanism of this step is that any permission granted to a parent node will be automatically and recursively passed to all its subordinate nodes within the authorization topology. For example, when the "CTO" node (Chief Technology Officer) is granted access to the "All R&D Project Database," its subordinate "Architecture Team Manager," "Development Team Manager," and even lower-level "Senior Architect" and "Development Engineer" nodes will automatically inherit this permission. This transitive inheritance mechanism deeply decouples permission management workload from organizational hierarchy, greatly improving management efficiency.

[0036] The final step of the method is the process of cascading business status data along the reverse path. This step is the opposite of the direction of permission transfer. Workstations or agents at the organization's bottom layer generate various business status data during task execution, and this data first converges to their respective workstation-based office space nodes. Subsequently, the data aggregation module, based on the reverse path of the authorization topology, further aggregates this data from different lower-level workstation-based office space nodes to the upper-level workstation-based office space nodes.

[0037] In this process, the aggregated business status data can specifically be a DTV dataset, which encapsulates information across three dimensions: data flow, trust link, and value point, comprehensively describing the status and output of business activities. Through hierarchical aggregation, these dispersed DTV datasets ultimately converge at the top-level node, such as the CEO node (CEO being the Chief Executive Officer), to form a global, comprehensive organizational context. This organizational context provides top-level decision-makers with a real-time, multi-dimensional dashboard of organizational operational status, enabling them to make more accurate strategic decisions based on data. This demonstrates the unique value of this invention, transcending traditional access control and empowering business decision-making.

[0038] In a preferred embodiment, DTV uplink aggregation specifically includes: each workstation's agents transmit business data and its generated value and cost information during task execution; the data transmitted by all agents under the same workstation-based office space node is first aggregated into the node's DTV dataset; based on trust-linked uplink data authorization, higher-level nodes can read the DTV datasets of all their lower-level nodes, and the data flows hierarchically in the reverse direction of the authorized topology; each level node can apply aggregation functions or custom formulas to the read data to form corresponding level business insights, and the top-level node ultimately obtains a global data and value view. The result of the hierarchical aggregation serves as input, providing real-time data support at the organizational dimension for upper-level organizational decisions or goal alignment.

[0039] A key feature of this invention lies in its dynamic management capability, namely, its ability to respond in real time to changes in organizational structure. For example... Figure 3 As shown, this dynamic management process begins with the step of detecting organizational structure change events. In one specific implementation, the system uses an event listening module, employing message queue technology (such as Kafka), to subscribe to and receive organizational change events from external source systems such as the enterprise HR system. These events are diverse, including new employee onboarding, employee job transfers, employee offboarding, and departmental restructuring. Through this event-driven architecture, the authorization system and the HR system achieve millisecond-level synchronization, ensuring that the authorization topology always accurately reflects the latest organizational status.

[0040] Upon receiving a change event, the system executes the following steps: locating the affected local subgraph. Unlike traditional solutions that require a full reconstruction of the entire permission graph upon a change, this invention employs an efficient incremental update strategy. The incremental update module starts from the starting node involved in the change event (e.g., the node corresponding to the employee being transferred) and utilizes the efficient adjacency query function of the graph database (e.g., using TRAIL query in Neo4j) to traverse along the forward and reverse paths of the authorization topology, thereby accurately identifying the smallest set of nodes affected by this change, i.e., the local subgraph. This precise location capability is a prerequisite for achieving efficient updates.

[0041] After locating the local subgraph, the system proceeds to the step of recalculating permissions within the subgraph. The incremental update module recalculates the permission inheritance relationships only for nodes within the local subgraph, while the permission status of all nodes outside the subgraph remains unchanged. This "surgical" update method has a computational complexity of O(k·log n), where k is the number of affected nodes and n is the total number of nodes in the organization. Compared to the O(n^2) or O(n^2) complexity of a full reconstruction, this is significantly more efficient. The complexity of m) makes its performance advantages extremely significant. For example, in an organization with 1000 workstation-based office space nodes, when a job change only affects 5 nodes, the computational cost of this invention is only 0.5% of that of a full reconstruction method, which enables the system to maintain high responsiveness even in large and frequently changing organizations.

[0042] To ensure access security during dynamic changes, this invention immediately executes the following step after access recalculation: triggering online access conflict detection. This is a proactive security mechanism performed by the online conflict detection module. This detection is triggered instantly, ensuring that any potential conflicts introduced by changes are detected immediately, rather than waiting until offline analysis afterward.

[0043] Online permission conflict detection specifically involves scanning for various types of conflicts. One type is mutually exclusive permission conflicts, which detect whether a node inherits two mutually exclusive permissions simultaneously based on predefined mutual exclusion rules (e.g., "financial approval permission" and "financial execution permission" are mutually exclusive). The detection algorithm traverses the final permission set of the affected nodes to check for conflicts. Another type is permission escalation conflicts, which aim to discover whether a node has obtained permissions beyond the scope of its job role through unexpected paths. For example, an "employee-level" node obtains "VP-level" (VP stands for Vice President) data visibility through an indirect authorization path. The detection algorithm compares the node's actual inherited permission set with the standard permission template corresponding to its role to identify "out-of-bounds" permissions.

[0044] Furthermore, the detection includes analysis of unauthorized path conflicts to identify "illegal" authorization shortcuts that bypass normal management levels. For example, a low-level employee node might be granted permissions directly by the CEO node, bypassing all intermediate managers. The detection algorithm analyzes hierarchical jumps in the authorization path to identify such non-compliant authorization relationships. Through comprehensive detection of at least these three conflict types, the system can build a robust permission security defense.

[0045] Upon detecting a permission conflict, the system executes steps according to a pre-defined strategy: The handling strategy is typically associated with the conflict's risk level. For high-risk conflicts, such as severe mutual exclusion permission conflicts, the system can block the change, rolling back the current change and reporting the error to the administrator to prevent a dangerous situation. For medium-risk conflicts, such as minor permission escalation, the system can issue an alert, allowing the change to take effect but generating a detailed alert log to notify the relevant administrator for manual auditing and confirmation. For low-risk conflicts or those with clear remediation rules, such as redundant authorization paths, the system can automatically disconnect the conflicting path, automatically deleting the redundant or non-compliant directed edge causing the conflict. Through this combined, automated handling strategy, the system can not only detect problems but also intelligently resolve some issues, significantly reducing the need for manual intervention.

[0046] To illustrate the implementation process and beneficial effects of the method and system of this invention more specifically, several typical application scenarios will be used as examples below. In a new employee onboarding scenario, suppose a senior architect is added to the "Architecture Team" under the CTO of a technology company. First, the onboarding process in the HR system generates an organizational structure change event, which is captured by the event listening module of the access control system via a message queue. The event content includes information such as the new employee's position (senior architect), department (architecture team), and direct supervisor (architecture team manager).

[0047] Upon receiving the event, the modeling module creates a new workstation-based office space node for the "Senior Architect" position in the graph database. When this node is created, its four internal partitions are initialized accordingly: the avatar partition binds to the new employee's agent identity; the management partition inherits the general management strategy template from the "Architecture Group"; the workstation partition creates a new workstation entity and binds it to an agent; and the inspiration partition is initialized to empty. Next, the topology building module creates a directed edge from the "Architecture Group Manager" node to this new "Senior Architect" node.

[0048] After the authorized topology changes, the incremental update module immediately initiates, using adjacency lookup to locate the affected local subgraph containing only the "Architecture Group Manager" and the new "Senior Architect" nodes. The system only recalculates permissions for these two nodes, and the new "Senior Architect" node automatically inherits all permissions from its parent node. Next, the online conflict detection module performs three types of conflict checks on the new node's permission set, all of which pass. Finally, the system configures the DTV data acquisition channel for the new node.

[0049] In another employee reassignment scenario, suppose a development engineer is transferred from the "Development Team" to the "Testing Team." The reassignment event pushed by the HR system triggers an authorization topology update in the permission system. Specifically, the system first deletes the directed edge between the employee's corresponding node and the "Development Team Manager" node, and then creates a new edge connecting the employee's node and the "Testing Team Manager" node. The incremental update module identifies the affected nodes as the employee's node, the original Development Team Manager node, and the new Testing Team Manager node—a total of three—and only recalculates permissions for them.

[0050] During the subsequent online conflict detection, the system discovered a mutual exclusion permission conflict: due to residual permissions, the employee node may have inherited both "code submission permission" from the development team and "test execution permission" from the testing team, which are defined as mutually exclusive in the rules. At this point, the system, according to its preset conflict handling strategy, took action to block the change and automatically correct it. Specifically, it automatically disconnected the path leading to the inheritance of "code submission permission," preserved the "test execution permission" required for the new position, and generated a report to notify the administrator for confirmation.

[0051] In a more complex departmental merger scenario, suppose the company decides to merge the "Brand Group" (containing 3 positions) and the "Growth Group" (containing 4 positions) into a new "Marketing Department." The batch change event pushed by the HR system will trigger a series of graph operations. The system first creates a new workstation-based office space node for the "Marketing Department," and then redirects all the parent authorization edges of the nodes that originally belonged to the two groups (a total of 7 positions) to this newly created "Marketing Department" node.

[0052] The incremental update module, through adjacency lookup, accurately located the local subgraph affected by this batch change, containing a total of 12 nodes (7 employee position nodes + 2 former manager nodes + 1 new department node + 1 higher-level CMO node, where CMO stands for Chief Marketing Officer). The system only performs permission recalculation on these 12 nodes, with a computational complexity of O(12·log n), far lower than a full update. In batch conflict detection, the system may detect and handle multiple conflicts, such as issuing alerts for two positions with mutual exclusion risks and automatically disconnecting redundant authorization edges on one position caused by permission bloat. Simultaneously, the DTV data aggregation path is also automatically updated to match the new organizational structure.

[0053] Finally, in a scenario demonstrating DTV uplink aggregation and decision support, the CTO needs to obtain the overall business status of the entire technology team as organizational context input for top-level decision-making. Business data generated by various workstations or agents in their daily work (such as code submissions, bug fixing, and review participation) is collected by the system as part of the DTV dataset. This data is first aggregated to its respective workstation-based office space node.

[0054] Subsequently, the data aggregation module follows the reverse path of the authorized topology, aggregating these DTV datasets from various R&D teams layer by layer upwards. For example, data from "Development Engineers" is aggregated to the "Development Team Manager" node, data from "Architects" is aggregated to the "Architecture Team Manager" node, and the data from these two manager nodes is further aggregated to the "CTO" node. Ultimately, the CTO node obtains an aggregated, real-time, multi-dimensional global view of all technical activities within its jurisdiction. This view serves as the organizational context for analyzing strategic issues such as R&D efficiency, identifying project risks, and optimizing resource allocation. The CTO can also drill down to view detailed data from any subordinate organization through a visual dashboard, based on authorized trust links, achieving comprehensive insights from macro to micro levels.

[0055] like Figure 4 As shown, this invention also provides a topology-based authorization-based intelligent agent platform permission management system. This system complements the above-described method and, in a preferred embodiment, includes multiple collaborative functional modules. The modeling module is responsible for organizational modeling in a graph database. Its core task is to abstract and map actual positions within the enterprise into independent workstation-based office space nodes. This module ensures that the digital representation of the organizational structure achieves job-level accuracy, laying the foundation for subsequent permission management and data aggregation. Through this modeling module, the organizational structure is no longer a flat user list, but a hierarchical and persistent network of positions, achieving accurate simulation of the workstation-based intelligent agent platform's organizational form.

[0056] In the system architecture, the topology building module follows the modeling module. Its main function is to use directed edges to connect the various workstation-based office space nodes created by the modeling module, thereby constructing a top-down authorization topology that reflects the company's actual reporting relationships. For example... Figure 5 As shown, this authorization topology clearly demonstrates the hierarchical relationships between nodes, with each directed edge representing a specific authorization action. Through the work of the topology building module, discrete job nodes are organized into an ordered and computable graph structure, providing a structural foundation for the automated and rule-based transfer of permissions.

[0057] The permission transfer module is responsible for implementing the flow of permissions within the authorization topology. Based on the structure of the authorization topology, this module executes a transitive inheritance algorithm for permissions. Specifically, when a permission is granted to a parent workstation node, the permission transfer module automatically propagates this permission downwards along all directed edges originating from that node, ensuring that all its direct and indirect subordinate nodes inherit this permission. This design greatly simplifies the complexity of permission allocation; administrators only need to authorize higher-level nodes, and the permissions automatically cover the entire organizational branch under their jurisdiction, thus achieving automation and efficiency in permission management.

[0058] Corresponding to the top-down transfer of permissions, the data aggregation module is responsible for the bottom-up aggregation of business status data. This module utilizes the structure of the authorization topology but operates along its reverse path. Business status data generated by the underlying workstation-based office space nodes, under the action of the data aggregation module, is aggregated upwards from lower-level nodes to their direct or indirect superior nodes along the reverse direction of the directed edges. Thus, superior nodes can obtain an aggregated view of the business status data of all lower-level nodes within their jurisdiction, achieving a hierarchical insight into the organizational status.

[0059] To enable the system to dynamically adapt to changes in the enterprise organization, the access control system also includes a series of auxiliary modules. The event listening module, as a crucial input interface, is responsible for monitoring organizational structure change events from external source systems (such as the enterprise HR system). This module ensures that the access control system is no longer an isolated, static system, but rather can interact with the enterprise's core management system in real time, guaranteeing consistency between the access control topology and the actual organizational structure.

[0060] When the event listening module receives a change event, the incremental update module is activated. This module is responsible for efficiently and accurately modifying the authorization topology based on the event content, rather than performing a costly global rebuild. By adopting a local update strategy, the incremental update module significantly improves the system's response speed and performance when facing frequent organizational changes, ensuring the availability and real-time performance of the access control system.

[0061] After the incremental update is completed, the online conflict detection module is triggered immediately to proactively detect any permission conflicts that may be caused by the change. This module is the core guarantee of system security, as it can identify and handle potential permission risks before they take effect. Through the collaborative work of the modeling module, topology construction module, permission transfer module, data aggregation module, and auxiliary modules, this invention constructs a closed-loop, dynamic, and secure permission management system.

Claims

1. A method for managing permissions on an intelligent agent platform based on topology authorization, characterized in that, include: In the graph database, organizational modeling is carried out using workstation-style office space nodes that represent enterprise positions as the basic units. A top-down authorization topology is constructed by connecting the workstation-based office space nodes using directed edges that represent authorization relationships. Based on the authorization topology, permissions are transitively inherited from the upper-level workstation-based office space node to the lower-level workstation-based office space node along the directed edge. Based on the authorized topology, business status data is aggregated from lower-level workstation-based office space nodes upwards along the reverse path of the authorized topology, so that higher-level workstation-based office space nodes can read it.

2. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 1, characterized in that, The workstation-based office space node includes: an avatar area for managing the identities of intelligent agents stationed at the node, a management area for configuring management strategies, a workstation area for managing workstation entities, and an inspiration area for storing historical decisions.

3. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 1, characterized in that, The business status data is a DTV dataset containing data streams, trust links, and value points. The DTV dataset is ultimately aggregated to form an organizational context for top-level decision-making.

4. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 1, characterized in that, The method further includes: establishing a trust link based on the authorization topology, wherein the trust link includes a bidirectional authorization link for uplink data authorization and downlink command authorization, and follows the workstation inheritance rule and the peer isolation rule; wherein, the workstation inheritance rule refers to the persistent binding of permissions to workstation-based office space nodes, and when the binding relationship between an agent and a node changes, the new agent automatically inherits the permissions of that node; the peer isolation rule refers to the fact that peer nodes at the same level in the authorization topology have no permission granting relationship by default.

5. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 1, characterized in that, The method further includes updating the authorization topology in response to detecting an organizational structure change event from an external source system.

6. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 5, characterized in that, The update of the authorization topology includes: starting from the starting node corresponding to the change event, traversing along the authorization topology to locate the affected local subgraph, and performing permission recalculation only on the nodes within the local subgraph.

7. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 5, characterized in that, The detected organizational structure change events from external source systems include: receiving organizational change events from the enterprise HR system via a message queue.

8. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 6, characterized in that, The method further includes: immediately triggering online permission conflict detection after the permission recalculation is completed.

9. The method for managing permissions of an intelligent agent platform based on topology authorization according to claim 8, characterized in that, The online permission conflict detection includes detecting at least one of mutual exclusion permission conflicts, permission escalation conflicts, and unauthorized path conflicts; and the method further includes: based on the risk level of the detected permission conflict, adopting a conflict handling strategy of blocking changes, issuing alarms, or automatically disconnecting conflict paths.

10. A topology-based authorization-based intelligent agent platform permission management system, characterized in that, include: The modeling module is used to perform organizational modeling in a graph database using workstation-based office space nodes that represent enterprise positions. The topology building module is used to connect the workstation-based office space nodes using directed edges representing authorization relationships to construct a top-down authorization topology; The permission transfer module is used to transfer permissions transitively from the upper-level workstation-based office space node to the lower-level workstation-based office space node along the directed edge based on the authorization topology. The data aggregation module is used to aggregate business status data from lower-level workstation-based office space nodes upwards along the reverse path of the authorized topology, based on the authorized topology, so that the upper-level workstation-based office space nodes can read it.

Images