Skip to main content

Blueprint: Executive Inbox Shield

Protecting Privileged Communications in Conversational AI​

Personal assistant agents often have access to email and calendar tools. A real risk is a non-executive user (or a hijacked session) using an agent to read or delete sensitive emails from C-suite accounts.

This blueprint demonstrates how to implement User-Resource Isolation for communication tools.

Architecture​

1. Master Policy Definition​

Allow only the CEO's self-access rule and rely on deny-by-default for every other principal.

{
  "name": "executive-data-protection",
  "priority": 9500,
  "rules": [
    {
      "id": "allow-self-access",
      "effect": "allow",
      "principals": ["user:ceo"],
      "actions": ["email:*"],
      "resources": ["user/ceo/*"]
    }
  ]
}

2. Implementation​

Python Prototype​

from openai import OpenAI
from controlzero import Client

guard_client = Client()

def request_email_action(user_id: str, action: str, target_mailbox: str):
    client = OpenAI(
        api_key="ignored",
        base_url="http://cz-gateway:8001/v1",
        default_headers={"X-ControlZero-User-ID": user_id}
    )

    try:
        response = client.chat.completions.create(
            model="gpt-5.4",
            messages=[{"role": "user", "content": f"{action} messages in {target_mailbox}"}],
            tools=[{
                "type": "function",
                "function": {
                    "name": f"email:{action}",
                    "parameters": {"type": "object", "properties": {"mailbox": {"type": "string"}}}
                }
            }]
        )
        # The Gateway does not derive `resource` from the generated mailbox
        # argument. Guard the operation immediately before executing it.
        decision = guard_client.guard(
            "email",
            method=action,
            args={"mailbox": target_mailbox},
            context={"resource": target_mailbox},
        )
        if decision.denied:
            return "Application-side policy denial; email operation not executed"
        return "Action Permitted"
    except Exception as e:
        return f"Access Denied: {e}"

# Scenario A: CEO accessing own mail
print(request_email_action("ceo", "read", "user/ceo/inbox")) # ALLOWED

# Scenario B: Staff member trying to read CEO mail
print(request_email_action("staff-1", "read", "user/ceo/inbox")) # BLOCKED

3. Validation Checklist​

  • Identity Matching: Verify that the user:ceo principal exactly matches the X-ControlZero-User-ID header.
  • Wildcard Scoping: Ensure that user/ceo/* protects all sub-folders (inbox, sent, drafts).
  • Audit Review: Confirm that all access attempts to executive resources are logged for security auditing.