SSO, OAuth and RBAC: access control for AI apps
An enterprise will not deploy an AI system that anyone can use or that can see everything. Three ideas cover most of what you need: single sign-on for who the user is, OAuth for what an app may access on their behalf, and role-based access control for what each role may do.
Three questions, three tools
| Question | Usually answered by | What it gives you |
|---|---|---|
| Who is this user? | Single sign-on (SSO) through the company's identity provider | A verified identity, without your app storing passwords |
| What may this app do for them? | OAuth 2.0 tokens | Scoped, expiring access to another system on the user's behalf |
| What may this role see and do? | Role-based access control (RBAC) | Rules such as managers can see salary bands, staff cannot |
Single sign-on
With SSO, users log in with the account the company already manages, through an identity provider such as Microsoft Entra ID, Okta or Google Workspace. Your app receives a verified identity and group memberships, commonly through OpenID Connect or SAML. When someone leaves the company, their access to your app ends too.
OAuth for tools
When an agent reads a user's calendar or CRM, it should not use one shared admin login. OAuth lets the user grant the app a token with specific scopes, such as read-only access to their own records. Tokens expire, so an agent must handle an expired token gracefully instead of failing mid-task.
RBAC for data and actions
Roles map groups of users to permissions. For AI systems, apply them in two places.
- Retrieval. Filter documents by the user's permissions before anything reaches the model. A model cannot leak a document it never saw.
- Actions. Check the role before a tool runs, not after the model has decided to use it.
Audit everything
Log who asked, what the agent retrieved, which tools it called and what it returned. Security teams will ask for this, and it is how you answer "why did it do that" after an incident.
- SSO says who, OAuth says what the app may reach, RBAC says what the role may do
- Filter retrieval by permission before the model sees anything
- An agent inherits the user's access, never more
- List every system your agent touches and write whose permissions it uses for each
- Pick one document that only managers may see and describe exactly what stops a non-manager from retrieving it
Every expert started right here.