Vantage Insurance: The Auto Assistant Answers With a Service Account
Vantage Insurance has rolled out a MicroStrategy Auto assistant to 600 HR managers. The assistant answers natural-language questions over a project containing salary, bonus, performance rating, and headcount data. Row-level security restricts each manager to their region. The assistant runs under a service account named AutoSvc, which belongs to a group with 'Bypass all security filters' and broad object access. An APAC manager asked for average salary by department across all regions and received a global figure. The audit log shows 23 such queries in two weeks. The LLM vendor retains prompts for 30 days. Auto can also create derived metrics at question time, and some users have asked for employee-level lists. No data-classification tags are applied to salary or performance fields.
1. Explain the root cause. Why is this an access-control failure rather than a model hallucination?
Read the worked answer
The assistant authenticates to the Intelligence Server as AutoSvc, so security filters and object ACLs are evaluated for AutoSvc, not for the APAC manager. If AutoSvc is in a group with 'Bypass all security filters', the region filter is not applied at all. The result is a correctly computed global average returned to a user who should see only APAC. That is authorization failure, not a hallucination.
The natural-language layer may add a second failure: if it can generate derived metrics or query objects outside the certified semantic layer, it can construct a question that the governed model would not permit. The 30-day vendor prompt retention is a separate data-egress issue. The audit log proves the queries occurred, but the absence of a user-context check is the core defect.
A model that answers fluently from an over-privileged account is behaving as configured. The fix is to pass the end user's identity through to the semantic layer, remove bypass, and constrain the assistant to governed objects. Blaming the model would leave the same exposure in place.
2. Design the control set for the assistant. Cover identity, semantic-layer authorization, model behavior, vendor handling, and monitoring.
Read the worked answer
Identity: use SSO or OAuth pass-through so every question executes as the requesting user. Remove AutoSvc from bypass groups, apply least privilege, and verify that the assistant cannot switch identities. Semantic layer: apply row-level security filters to salary and performance data, restrict the assistant to certified attributes, metrics, and datasets, and disable free-form SQL or ad hoc table access. Disable derived metrics unless they are built from certified components and reviewed.
Model behavior: allowlist the questions and objects the assistant may use; refuse employee-level salary lists; aggregate or mask sensitive fields; add classification tags and a data dictionary so the assistant can explain scope. Vendor handling: require zero or short retention, no training on Vantage data, encryption, regional processing, and a right to audit. Log prompts and responses with access controls, but do not log full sensitive values.
Monitoring: alert on cross-region queries, bypass-group membership changes, unusual question volume, and employee-level requests. Run red-team tests with managers from each region. Require human review for compensation questions and provide a clear escalation path for incidents.
3. The CHRO wants to extend the assistant to compensation planning, including individual salaries. What is your recommendation?
Read the worked answer
Do not extend the current assistant to individual salaries. Compensation planning is a high-risk use case with legal, privacy, and fairness implications, and the existing control set is not yet proven. A natural-language interface that can generate derived metrics and return employee-level lists is the wrong tool for that data without a separate design.
If the business proceeds, require a restricted project, CHRO and Legal approval, a privacy impact assessment, and a defined purpose. Use aggregated data with a minimum cell size, such as ten employees, and suppress small cells. Disable employee-level retrieval and free-form SQL. Keep individual salary planning in a governed workflow with named roles, approval steps, and audit, not in a general question-and-answer bot. Apply masking and classification tags, and test for inference attacks such as combining department averages with headcount.
Set a go/no-go gate: successful red-team results, vendor retention terms, incident response, and user training. If any gate fails, deny the use case. The default should be to protect the data, not to expand the assistant because a senior sponsor asked.