Dual-Layer Permissions Enforcement

Overview

In AI-driven workplaces, secure access to knowledge is as important as delivering the right answer. At Doti, we’ve designed a multi-layered permissions framework to ensure that every answer is contextually relevant - and fully compliant with your organization's data access policies.

Our approach enforces document-level permissions dynamically and intelligently - so users only ever see what they’re allowed to see.

How It Works

Every time a user interacts with Doti - whether through Slack, a browser extension, or the web interface - our system evaluates the user's identity and access rights in real time, before including any data in the response.

The result? A zero-leakage architecture where unauthorized content is completely invisible to users who should not have access.

Dual-Layer Permissions Enforcement

Doti uses two complementary mechanisms to enforce document-level security:

1. Source-Level Permissions

For every integration that supports it (like Google Drive, Slack, Confluence, Jira, etc.), Doti respects and enforces native access control directly via the platform’s API. This includes:

  • File- and folder-level access in Google Drive

  • Page and space permissions in Confluence

  • Object and field-level permissions in Salesforce

Whenever a user sends a query, Doti performs a real-time API check to determine whether they have access to each resource. Documents that don’t pass this check are excluded silently - the user won’t know they exist.

Security by design: If a user isn’t allowed to see a document in the original tool, they won’t see it in Doti either.

2. Agent-Level Access Zones

For apps that don’t support real-time permission APIs (e.g., Gong, some internal systems), Doti offers agent-level access controls:

  • Agents can be restricted to only specific teams or roles

  • A "restricted zone" can be created where only authorized users can interact with specific data sources

  • Admins define which users or groups are allowed to query each integration or data type

Example: You can limit Gong call analysis to your RevOps team by scoping a dedicated Gong Agent to only that group.

Real-Time Enforcement in Action

Here’s how Doti enforces permissions step-by-step:

  1. User Identification: Doti identifies the specific user (via SSO, Slack, or browser extension).

  2. Permission Evaluation:

    • If source-level permissions are enabled, Doti checks each document through the integration API.

  3. Filtering:

    • Only authorized documents are added to the context.

    • Unauthorized content is fully excluded - never hinted at, leaked, or referenced.

  4. Answer Generation: The LLM generates a response based only on the allowed context.

Combining Source & Agent Permissions for Maximum Control

To achieve the highest level of precision, you can combine both layers:

  • Use source-level permissions to enforce access based on the originating app

  • Use agent-level controls to further restrict access by user group or business unit

For example: A “Management” agent can be scoped to executives and configured to enforce both Google Drive permissions and Doti-level access rules, ensuring no one below management ever accesses sensitive board materials - even accidentally.

Flexible Permission Toggles

We understand that not all data needs to be strictly protected. That’s why permissions can be toggled at both the integration and agent level:

  • Want to allow broader sharing of non-sensitive content (like a team handbook or product wiki)?

    • You can disable source-level permissions for those integrations or agents.

  • Want strict enforcement for financials or legal docs?

    • Enable both source-level and agent controls for total lockdown.

This flexibility allows organizations to balance accessibility with security, instead of forcing one-size-fits-all rules.

Summary

Feature
Description

Real-Time Filtering

All documents are filtered per user identity in real time

Zero Leakage

Unauthorized content is completely hidden from view

Source-Level Permissions

Enforced via native integration APIs

Agent-Level Zones

Restrict agents to teams, roles, or business units

Combined Enforcement

Supports both source and agent policies simultaneously

Toggleable Controls

Source permissions can be turned off at the agent or integration level

With Doti, every answer is secure by default - empowering your teams with knowledge, without ever compromising your data.

PreviousLive, Dynamic Salesforce SearchNextWhat is an Agent?

Last updated

Was this helpful?