Integrating AI assistants into business software often creates a dangerous permission mismatch. Developers frequently grant the AI a service account with broad API access, allowing it to approve invoices or move purchase orders. This setup inadvertently gives the assistant more authority than the human user, enabling privilege escalation where a junior employee can trigger actions they are not authorized to perform.

The Guarded Execution Model

Inaya Business Workspace addresses this with a framework called "guarded execution." The core rule is simple: the AI proposes, it never executes. When an assistant suggests a change, such as marking an invoice as paid, it creates a PENDING action request containing the target record and the proposed reason. The actual database record remains untouched until a human explicitly approves the request.

Re-checking Permissions at the Gate

Approval isn't just a UI button; it triggers a server-side permission check. The function resolveCanApprove re-derives the exact permission logic used by the manual transition functions for each record type. This ensures that an AI-proposed action can only be approved by a person who already has the authority to perform that action manually. This approach maintains a single source of truth for permissions, preventing the AI's permission model from drifting away from the application's core security logic.

Testability and Audit Trails

The permission gate is implemented as a plain library module with no dependency on the web framework, allowing developers to unit-test it directly with node --test. This separation is critical for security boundaries that change frequently. Additionally, every proposal, approval, and rejection is written to an activity log. This ensures that "the AI did it" is never the final answer; there is always a documented human approver and a record of the specific changes proposed.

Key Takeaways

  • AI assistants in business software should default to proposing changes rather than executing them to prevent privilege escalation.
  • Permission checks for AI actions must mirror the exact logic used for manual user actions to maintain a single source of truth.
  • Isolating permission gates into plain modules enables fast unit testing with tools like node --test without HTTP overhead.
  • Comprehensive audit logs must record the human approver for every AI-initiated action to ensure accountability.

The Bottom Line

This friction is annoying for trivial tasks but essential for finance and HR. If you're building AI into a multi-user app, don't let the assistant out-authorize the user.