Earlier quoted context omitted.
Security is an interesting challenge. The way we approach it is that we assume the LLM will spit out actions that are wrong or harmful. So everything needs to be handled with old school permissions. Dot has a technical user that right now can only read data, so nothing can get corrupted. And second we have an extra layer where we make sure that the user who asks the question has access to the tables that are accessed…
That sounds like the right way to handle it. What about the Python code that is run? That seems harder to lock down than the read-only data permissions.
Python is hard, right now we utilize OpenAI's code interpreter for that, which isolates the workloads pretty well at the cost of speed.
I'm hoping we can improve that trade-off in the coming weeks.