Identity-Based RAG Context Using Security Group Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing generative AI chat platforms for large organizations face inefficiencies due to uncoordinated development, lack of enterprise features like security and compliance, and require significant software engineering knowledge, making it difficult to share and compare results effectively.

Innovation Solution

An identity-based context generation system using security group assignments, which includes a generative AI chat platform with an access-controlled RAG-based information retrieval system, language model selection module, and multi-source data embeddings, ensuring responses are limited to data accessible by the user's security group, and allowing for secure, customizable chat assistant sharing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If uncoordinated development approaches are used for chat platforms, then individual teams can independently build solutions, but enterprise features like security and compliance cannot be effectively implemented

Engineering Contradiction:

Improveindividual team autonomyVSAvoidenterprise security and compliance

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system segments chat assistants by assigning them to specific security groups, allowing individual teams to develop autonomous chat assistants while maintaining enterprise-wide security controls. Each chat assistant is associated with a security group that defines its access permissions to embedded data sources.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary access control mechanism that mediates between individual chat assistant development and enterprise security requirements. The system uses security group assignments and access control lists to bridge team autonomy with compliance requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If comprehensive security controls are implemented for all users, then data access is protected, but system complexity increases

Engineering Contradiction:

Improvedata access securityVSAvoidaccess control system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system implements a universal access control mechanism where security groups serve multiple purposes: they define user permissions, control chat assistant access to data sources, and manage embedded data source security. This multi-functional approach reduces overall system complexity while maintaining comprehensive security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If chat assistants access all available data sources, then response accuracy improves, but security and compliance requirements are violated

Engineering Contradiction:

Improveresponse accuracyVSAvoidsecurity and compliance violations

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The system applies local quality by assigning different access permissions to different security groups for different embedded data sources. Each chat assistant receives context from data sources appropriate to its security group, ensuring both accuracy and compliance with security requirements.

Inventive Principle:

Principle #3Local quality

4Reliability

If extensive software engineering knowledge is required for chat assistant deployment, then system robustness improves, but ease of deployment deteriorates

Engineering Contradiction:

Improvesystem robustnessVSAvoiddeployment ease

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The system enables self-service deployment by allowing users to create and configure chat assistants through simplified interfaces. Security group assignments and data source connections are managed automatically by the system based on user roles, reducing the need for extensive software engineering knowledge while maintaining robustness.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20260044754A1Identity-based context generation for language models using security group assignments

Publication Date: 2026.02.12 DELL PROD LP

AI summary

Techniques are provided for identity-based context generation for language models using security group assignments. One method comprises obtaining a user query; obtaining information characterizing an assignment, based on an identity-based authentication of the user, of the user to a security group; providing the user query to an information retrieval system that generates query results using embedded data sources accessible by the security group of the user; providing the user query with at least a portion of the query results as context to a language model, associated with a chat assistant, to obtain a response, wherein the response is based on one or more of the query results; and providing the response to a user. A platform may be provided that allows chat assistants and/or embedded data sources to be shared with other users.