FDE Permission Handover: Access after an Employee Changes Departments

The PostgreSQL documentation explains row-level access policies and their applicable boundaries. This article focuses on application permission design and does not require readers to switch to this database, nor is it equivalent to ChinaOPC itself adopting this function.

The permission basis must come from the enterprise system

To simulate employees moving from sales to operations, the AI service should read the confirmed identity and role information and prevent users from declaring their departments in the chat. The access scope is calculated by the application and cannot be determined by the prompt word alone.

Revocation overwrites derived results and cache

Old conversation or search caches may still display content even if the original file is no longer accessible. FDE needs to list relevant storage, determine the rules for reading after rights are revoked, and explain how historical materials will be handled. You can't just verify that new queries are intercepted and end it.

Acceptance cross-check using different identities

Use the customer-approved test account to verify permissions, prohibitions, and role changes, and record the results and exceptions. Different mechanisms may exist for privileged roles such as database owner and the actual configuration should be checked. The inspection methods proposed in this article do not constitute a safety conclusion that a certain system has been isolated.

Extended reading: FDE case.