Permission at the Output Boundary

A permission check has a location.

Inside a data warehouse, that location may be a table, row, or column. A sales lead can see the accounts in one region. A finance partner can see compensation bands but not individual salaries. The boundary is enforced when the query runs.

Then the answer leaves.

OpenAI's new Data agent for ChatGPT Work can connect to approved warehouses, use an organization's metric definitions, investigate a question, and turn the analysis into an interactive dashboard. Queries inherit the connected account's existing restrictions. The resulting dashboard can be edited, shared, refreshed, or used to recommend and carry out another action.

The product's current documentation names an important seam. When a dashboard is published through Sites, the data used in the analysis is copied into the published site. The person sharing it is told to consider data permissions when choosing the audience.

The query respected its boundary. The answer has become a new object with a new one.

The documentation does not describe a data leak or an ignored control. It reveals a more ordinary engineering fact: access control changes shape when analysis becomes an artifact. Row-level security can decide what a person is allowed to ask. It cannot, by itself, decide what every future reader of the answer is allowed to know.

Anyone who has emailed a spreadsheet knows the older version of this problem. A governed database produces a CSV. The CSV travels to a laptop, then to a shared drive, then into a slide deck whose final audience is larger than the first one. Each transformation may reduce detail, combine sources, add interpretation, or quietly preserve a sensitive value. The source system remains carefully permissioned while its descendants acquire ordinary filenames.

What changes now is the distance between asking and publishing.

OpenAI describes people without specialist training building dashboards in plain language. Its data team reports a related internal workflow: a partner can reuse an analyst's method, refresh the result without reopening a request, and turn an investigation into an HTML application in the same conversation. This can make useful questions cheaper to ask. It also means a person who believed they were exploring data may become the publisher of a derived dataset before the organizational role change has had time to feel real.

Calling the dashboard a picture of the warehouse leaves too much out. It may contain query results copied from several systems, filters chosen during a conversation, assumptions inherited from a semantic layer, summaries produced from unstructured documents, and a recommendation formed from all of them. Refreshing it later may run the work again against changed data. Sharing it may place the result before people who could not have issued the original query.

The W3C's PROV-O standard offers useful language for this. A chart is an entity generated by an activity, derived from another entity, and attributable to an agent. That sounds formal until a dashboard becomes consequential. Then the plain questions are exactly the provenance questions: what did this use, how was it produced, when was it generated, and who accepted responsibility for the result?

Permission belongs in that chain too.

A share dialog for generated analysis should show more than a list of recipients. It should make the output boundary inspectable:

• which source systems and metric definitions contributed to the artifact
• whether the site contains copied results or a live, permission-checked view
• which filters, aggregations, or redactions shaped what is visible
• who can open the artifact, export it, or pass it along
• whether refreshes run with the creator's access, a service account, or the viewer's access
• when the data and the permission decision were last checked

The list is less glamorous than a dashboard appearing from a prompt. It is also what lets the dashboard become ordinary infrastructure instead of a surprisingly portable exception to it. NIST's Privacy Framework treats review, transfer, sharing, disclosure, alteration, and deletion as related governance work. Publishing an answer sits inside that lifecycle even when the original query was perfectly authorized.

This moves beside The Salary Slider Already Knows The Answer, but asks a different question. That Field Note examined the management theory encoded in a dashboard's arithmetic. Here, the arithmetic may be sound. The issue is what happens when a governed answer becomes a durable, distributable thing.

It also gives A Retention Policy for Thinking Out Loud another kind of record boundary. A conversation can become an archive without looking like one. An analysis can become a dataset without looking like one. In both cases, the interface should reveal the change before the person is asked to manage its consequences.

Self-service analytics should make more people capable of asking good questions. The corresponding design task is to show them when the answer has crossed into a new data object, then give that object an audience, provenance trail, refresh policy, and practical way to be withdrawn.