{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/enforce-permissions-outside-the-model",
  "id": "MHC-D-RESEARCH-0315",
  "version": "0.1.0",
  "title": "Enforce permissions outside the model",
  "summary": "A sentence in a prompt is guidance. An authorization check is a control.",
  "kind": "principle",
  "body": "Put access rules in deterministic downstream code or policy enforcement points that validate every protected request. The model can help choose an action, but it should not be the component that decides whether the caller is allowed to perform it.",
  "limits": [
    "Deterministic authorization still needs correct policy, testing, auditability and secure identity handling."
  ],
  "topics": [
    "union-ai-agent-control"
  ],
  "intents": [],
  "source_ids": [
    "RS-A650FC1839E382FF"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends enforcing critical authorization and privilege-separation controls independently from the LLM in deterministic, auditable systems.",
      "source_id": "RS-A650FC1839E382FF",
      "role": "supports",
      "note": "External controls still need correct policy design and testing; moving a decision out of the prompt does not make it correct automatically.",
      "locator": "Ensure security controls are enforced independently from the LLM"
    }
  ],
  "use_when": [
    "A workflow relies on prompt instructions such as 'never access other users' data' or 'only admins may delete.'"
  ],
  "avoid_when": [
    "Deterministic authorization still needs correct policy, testing, auditability and secure identity handling."
  ],
  "example": "A delete API checks the user's role and record scope even when the agent confidently claims the deletion is allowed.",
  "check": "Changing or bypassing the model prompt cannot bypass the downstream authorization rule.",
  "sources": [
    {
      "id": "RS-A650FC1839E382FF",
      "title": "LLM07:2025 System Prompt Leakage",
      "url": "https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/"
    }
  ],
  "relations": [],
  "collections": [
    {
      "id": "RC-EEF5F4530C11FD17",
      "title": "Let AI do useful work without giving it accidental authority",
      "url": "/collections/let-ai-do-useful-work-without-giving-it-accidental-authority"
    }
  ]
}