Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copilot broke audit logs, but Microsoft won't tell customers

pistachioapp.com

Post reply on HN
Print view View original

251–260 of 324 posts

Re: Copilot broke audit logs, but Microsoft won't tell customers

#251

Post by fkyoureadthedoc »

malfist wrote: post #212
DannyBee wrote: post #211

Earlier quoted context omitted.

"would be required on a per user basis or track the access rights along with the content, which is infeasible and does not scale" Citation needed. Most enterprise (homegrown or not) search engine products have to do this, and have been able to do it effectively at scale, for decades at this point. This is a very well known and well-solved problem, and the solutions are very directly applicable to the products you lis…

If you're stringing together a bunch of MCPs you probably also have to string together a bunch of authorization mechanisms. Try having your search engine confirm live each persons access to each possible row. It's absolutely a hard problem and it isn't well solved

I don't know the details, but I know if I give our enterprise search engine/api a user's token it only returns documents they are allowed to access.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#252

Post by thewebguyd »

everdrive wrote: post #209
planb wrote: post #158

I am assigned to develop a company internal chatbot that accesses confidential documents and I am having a really hard time communicating this problem to executives: As long as not ALL the data the agent hat access too is checked against the rights of the current user placing the request, there WILL be ways to leak data. This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a…

>communicating this problem to executives I don't just mean this as lazy cynicism; executives don't really want to understand things. It doesn't suit their goals. They're not really in the business of strictly understanding things. They're in the business of "achieving success." And, in their world, a lot of success is really just the perception of success. Success and the perception of success are pretty interchange…

> they often feel that a lot of engineering concerns should really be dismissed unless those concerns are truly catastrophic.

Grizzled sysadmin here, and this is accurate. Classic case of "Hey boss, I need budget for server replacements, this hardware is going to fail." Declined. few months later, fails. Boss: "Why did you allow this to happen, what am I even paying you for?"

Re: Copilot broke audit logs, but Microsoft won't tell customers

#253

Post by mh- »

scott_w wrote: post #230
pc86 wrote: post #228

Earlier quoted context omitted.

> I'm making an assumption on how these AI Agents work, I could be wrong. I don't understand the desire - borderline need - of folks on HN to just make stuff up. That is likely why you're being downvoted. I know we all love to do stuff "frOM fIRsT PRiNcIPlEs" around here but "let me just imagine how I think AI agents work then pass that off as truth" is taking it a bit far IMO. This is the human equivalent of an AI h…

And yet if we didn't do this, HN would be almost completely silent because 99% of commenters have a clue what they're talking about most of the time and nobody would ever have a chance to learn.

I don't know how to say this less flippantly, and I honestly tried: you could have simply posted a comment phrased as a question, and 20 people would have jumped in to answer.

(To your point, >15 of them would have had different answers and the majority would have been materially wrong, but still.)

Re: Copilot broke audit logs, but Microsoft won't tell customers

#254

Post by AllegedAlec »

jjkaczor wrote: post #35
lokar wrote: post #8

Wait, copilot operates as some privileged user (that can bypass audit?), not as you (or better, you with some restrictions) That can’t be right, can it?

So... basically like when Delve was first introduced and was improperly security trimming things it was suggesting and search results. ... Or ... a very long-time ago, when SharePoint search would display results and synopsis's for search terms where a user couldn't open the document, but could see that it existed and could get a matching paragraph or two... Best example I would tell people of the problem was users s…

Insecure by default. I remember in the previous place I worked we used ASP webforms. One of the major headaches I had to deal with is that by default, microsoft allows all users to view a page. I had to create huge scripts to go through the entire pagetree and check each's one's rights (moving up directories also because of course we also have cascading positive and negative rights), and output the results in the audits we did automagically each week.

One of the major issues was we could never properly secure the main page, because of some fuckery. At the main page we'd redirect to the login if you weren't logged in, but that was basically after you'd already gone through the page access validation checks, so when I tried to secure that page you wouldn't be redirected. I can't remember how, or even if I solved this...

Re: Copilot broke audit logs, but Microsoft won't tell customers

#255

Post by senko »

doomslice wrote: post #198
krisoft wrote: post #165

Earlier quoted context omitted.

> This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a per user basis or track the access rights along with the content, which is infeasible and does not scale. I don't understand why you think tracking user access rights would be infeasible and would not scale. There is a query. You search for matching documents in your vector database / index. Once you have found the pot…

Let's say you have 100000 documents in your index that match your query but only 10 of them the user has access to: A basic implementation will return the top, let's say 1000, documents and then do the more expensive access check on each of them. Most of the time, you've now eliminated all of your search results. Your search must be access aware to do a reasonable job of pre-filtering the content to documents the use…

Just use a database that supports both filtering and vector search, such as postgres with pgvector (or any other, I think all are adding vector search nowadays).

Re: Copilot broke audit logs, but Microsoft won't tell customers

#256

Post by sporkland »

planb wrote: post #158

I am assigned to develop a company internal chatbot that accesses confidential documents and I am having a really hard time communicating this problem to executives: As long as not ALL the data the agent hat access too is checked against the rights of the current user placing the request, there WILL be ways to leak data. This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a…

If you have a field like and acl_id or some other context information on the data that is linked closely to a user's files. You can pass in the user's set of those field values to the vector database to pre-filter the results and do a permissions post check with a fairly relevant set.

The vector db definitely has to do some heavy lifting intersecting the say acl_id normal index with the nearest neighbors search but they do support it.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#257

Post by sporkland »

giamma wrote: post #226
planb wrote: post #158

I am assigned to develop a company internal chatbot that accesses confidential documents and I am having a really hard time communicating this problem to executives: As long as not ALL the data the agent hat access too is checked against the rights of the current user placing the request, there WILL be ways to leak data. This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a…

I believe most vector databases allow you to annotate vectors with additional metadata. Why not simply add as metadata the list of principals (roles/groups) who have access to the information (e.g. HR, executives) ? Then when a user makes a request to the chatbot, you expand the user identity to his/her principals (e.g. HR) and use those as implicit filtering criteria for finding the closest vectors in the database.…

This is the correct answer. You do a pre-filter on a permissions correlated field like this and post-filter on the results for the deeper perms checks.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#259

Post by scott_w »

mh- wrote: post #253
scott_w wrote: post #230

Earlier quoted context omitted.

And yet if we didn't do this, HN would be almost completely silent because 99% of commenters have a clue what they're talking about most of the time and nobody would ever have a chance to learn.

I don't know how to say this less flippantly, and I honestly tried: you could have simply posted a comment phrased as a question, and 20 people would have jumped in to answer. (To your point, >15 of them would have had different answers and the majority would have been materially wrong, but still.)

So let me be more direct. The part I'm not confident I'm correct in is this:

> AI Agents, instead, directly access the database

However, I don't think I'd be too far off the mark given many systems work like this (analytics tools typically hook into your DB, to the chagrin of many an SRE/DevOps) and it's usually marketed as the easy solution. Also, I've since read a few comments and it appears I'm pretty fucking close: the agents here read a search index, so pretty tightly hooked into a DB system.

Everything else, I know I'm right (I've built plenty of systems like this), and someone was making a point that permissions access does scale. I pointed out that it appears to scale because of the way they're designed.

I'd say most of my comment is substantively correct, with a disclaimer on an (important) point, where I'd be happy to be corrected.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#260

Post by pierrebrunelle »

senko wrote: post #255
doomslice wrote: post #198

Earlier quoted context omitted.

Let's say you have 100000 documents in your index that match your query but only 10 of them the user has access to: A basic implementation will return the top, let's say 1000, documents and then do the more expensive access check on each of them. Most of the time, you've now eliminated all of your search results. Your search must be access aware to do a reasonable job of pre-filtering the content to documents the use…

Just use a database that supports both filtering and vector search, such as postgres with pgvector (or any other, I think all are adding vector search nowadays).

Agree...as simple as:

@pxt.query def search_documents(query_text: str, user_id: str): sim = chunks.text.similarity(query_text) return ( chunks.where( (chunks.user_id == user_id) # Metadata filtering & (sim > 0.5) # Filter by similarity threshold & (pxt_str.len(chunks.text) > 30) # Additional filter/transformation ) .order_by(sim, asc=False) .select( chunks.text, source_doc=chunks.document, # Ref to the original document sim=sim, title=chunks.title, heading=chunks.heading, page_number=chunks.page ) .limit(20) )

For instance in https://github.com/pixeltable/pixeltable

Post reply on HN