Private AI Permissions & Deployment Checklist
Private deployment is an architecture choice, not proof of security. Review every data path and test the actual permission boundaries.
Map every data flow
Inventory ingestion, OCR, embeddings, inference, logs, backups, telemetry and integrations. A local chat model can still depend on external services elsewhere. Record what leaves the environment, why, who processes it and retention. Review the implemented system rather than a product label.
Enforce permissions before retrieval
Users must not retrieve restricted information simply because it shares an index. Map source permissions to retrieval rules and test role changes and removals. Citations must not expose restricted titles, snippets or paths. ERP tools need a separate authorization boundary.
| Test | Expected behavior | Evidence |
|---|---|---|
| Restricted document request | No restricted passages or identifying citations | Role-based retrieval test |
| Replaced document | Old material follows removal rules | Revision and index check |
| Prompt asks to ignore rules | Permissions remain enforced | Adversarial test and logs |
| Sensitive ERP action | Approval precedes execution | Approval and execution record |
Evaluate answers and failure behavior
Use employee questions and deliberately ambiguous, unsupported or conflicting examples. Check source fidelity, citations, refusal and revision awareness. Fluency is not evidence of accuracy. Operational, financial and safety decisions need appropriate review.
Assign ongoing responsibilities
Specify who updates models, manages identities, reviews logs, tests recovery and handles incidents. Data export, ownership and vendor responsibilities belong in deployment scope. Document administrative access and recovery rather than assuming that private implies secure.
Start with a bounded pilot
A small collection with owners is easier to evaluate than the entire company drive. Begin read-only and route feedback to document owners. Add sources and actions after evaluation and permission tests remain satisfactory. This is general implementation guidance, not a security certification or assessment of your environment.
Questions before you start
Does RAG prevent all incorrect answers?
No. It can improve grounding but still requires evaluation, uncertainty and review.
Should AI follow instructions in retrieved documents?
Retrieved content is evidence, not authorization. Software controls must prevent document text from expanding permissions or bypassing approvals.
Start with one workflow worth improving.
Bring your systems, sample records and operating priorities. We will discuss fit, scope and the next decision.