This is a submission for the Permit.io Authorization Challenge: AI Access Control

What I Built

Presenting SecureLens 🔍: An internal company copilot tool to improve your productivity when dealing with several projects, clients, or internal company functions. SecureLens saves you the time for manually accessing crucial data in your day to day tasks. The best part, you can trust your copilot since all the risk of accidental data leaks and unauthorized AI outputs is handled for you using Permit.io.

Architecture

Architecture Diagram

Permissions

Permissions Diagram

Example Users 

[
{"username": "alicej", "password":"2025DEVChallenge", "role":"employee"}
{"username": "bobsmith", "password":"2025DEVChallenge", "role":"manager"}
{"username": "charliek", "password":"2025DEVChallenge", "role":"admin"}
]

Demo

ABAC Rules

emp can view pii

Employees can ivew PII data for only those ctomer for which they are accountable.

Project Repo

GitHub logo vivekthedev / securelens

📊 Secure AI Copilot with Fine-Grained Authorization

📌 Overview

An internal AI-powered assistant (Copilot) for enterprise environments that interacts with business-critical data systems — CRM, HR, and Financial databases — while enforcing granular, dynamic, and secure data access controls at every stage.

📊 Data Schema

Tables:

  • users (id, name, email, phone, role)
  • customers (id, name, email, phone, budget, address, assigned_emp_id)
  • hr_data (id, emp_id, designation, salary, benefits, department)
  • financial_data (id, vendor_name, amount, txn_date, notes)

📌 Why This Project

  • AI copilots are becoming integral to internal enterprise tools
  • Traditional RBAC isn’t enough for AI-generated dynamic content
  • We demonstrate secure AI data operations combining RBAC, ABAC, RAG filtering, and AI response enforcement — enterprise-ready and compliance-friendly




View on GitHub


My Journey

While going through the challenge description, a thought of Copilot tool came to my mind that can use Permit IO capability to serve data to only Authorised users and wouldn't it be better to have a Multi agent pipeline that takes the prompt, filters it, check the permission and return the response in a beautiful SQL table.

In any company, people spend a lot of time just searching, some technical ones could write their own queries but for the non-technical ones, they don't have this luxury and can only view the data with filters and conditions provided to them via a UI. This is where SecureLens come it, with its multi-agent capability and Authorization checks, it gives anyone the exact data you need. No risky queries, no unauthorized access, no wasted time.

In the beginning, the idea began with a document based tool which check the document's metadata and give output to the user if they are authorized. Later, I expanded the scope to include a few more agents to clean the prompt and access data from a SQL database using a dedicated agent.

I started with React, FastAPI and PydanticAI but due to time constraints and a little frontend knowledge. I decided to use Chainlit. Chainlit handles all the frontend part which let me focus more on Agents and Permissions.

In order to create agents, I used PydanticAI and Google Gemini LLM. With all the details ironed out. I began building my Policies and Agents.

Authorization for AI Applications with Permit.io

Permit IO turned out to be easier to work with then I initially thought. With easy to use UI creating policies was just a work of few clicks. Permit IO has three core concepts:

  • Roles: which are the actors
  • Resource: which are the entities on which the action needs to be performed
  • Action: the actual action to be performed by the actor

All of this can only be checked using Permit's check function. Every resources or attributes goes into this funciton and it returns True if the permission is granted or false otherwise. One other feature of Permit which I think was undercelebrated was defining resource as Parent-Child, which lets me easily define permission for parent and it get applied to the child automatically by a specific role.

Lastly, I used PermitIO's sync_user function to easily add all my users from the DB to the Permits workspace in a few seconds. One limitation I came across was that ABAC and ReBAC features currently work only within Docker container environments. It would be great to see native SDK support for these in local development in the future.

Conclusion

SecureLens is built to solve a growing problem of access control so that enterprises can integrate AI copilots into their system without risking data leaks and unathorized access. By participating and building in this hackathon I learned crucial concepts about AI access control, working with permissions and building agent.