AI  

AI Security: How AI assistants securely assess your personal data

Introduction

AI assistants are widely used in today's world, but can they access our personal data? How is security maintained during such AI interactions?

Imagine asking an AI assistant like ChatGPT, Microsoft Copilot, or Gemini to:

"Look at my calendar and find a free 30-minute slot tomorrow to meet with Sarah."

Within seconds, the AI reads your schedule, identifies your available time slots, and finds the perfect meeting time.

It feels like magic, but behind the scenes, a major security challenge is being solved. How does the AI read your private emails or calendar without knowing your master password, or worse, accidentally gaining access to files it shouldn't see?

The secret is a protocol called OAuth 2.0 On-Behalf-Of (OBO) Token Delegation. Instead of giving the AI a physical key to your corporate front door, the system uses a highly secure four-step process to let the AI act strictly on your behalf.

Let's see exactly how it works.

The 4-Step Process: How the AI Fetches Your Data

Step 1: The Initial User Login

The journey begins when you log into your work dashboard or chat interface using your standard company credentials.

After a successful login, the web browser receives a standard Access Token. This token acts as a digital identity card proving that you are authenticated.

When you submit your prompt asking the AI to check your calendar, your browser sends:

  • Your prompt

  • Your access token

to the AI Assistant backend.

Step 2: The On-Behalf-Of Token Exchange

The AI Assistant reads your prompt and realizes it needs to communicate with the Calendar API.

However, the Calendar API will reject the AI's existing access token because it was issued only for the AI application—not for Microsoft Graph or the Calendar service.

To solve this, the AI backend sends your existing access token to your organization's Identity Provider (such as Microsoft Entra ID, Google Identity, Okta, or another OAuth provider).

It essentially requests:

"I am the AI Assistant, and I already have the user's authenticated access token. Please exchange it for another token that allows me to access the Calendar API on behalf of this user."

Step 3: Generating the Scoped OBO Token

The Identity Provider validates the request and issues a brand-new On-Behalf-Of (OBO) Access Token.

This new token is highly restricted and guarantees two important security properties:

  • User Identity

    • The AI inherits only the permissions already granted to the authenticated user.

    • If the user cannot access a mailbox, calendar, or file, the AI cannot access it either.

  • Limited Scope

    • The token is generated only for the requested API and permissions.

    • For example, it may allow reading calendar events while explicitly preventing modifications or deletions.

Step 4: Fetching the Data Securely

Finally, the AI Assistant presents the newly issued OBO token to the Calendar API.

The Calendar API then:

  • Verifies the token cryptographically.

  • Confirms that the user has permission to access the requested resource.

  • Returns only the requested calendar information.

The AI processes the returned data and presents it as a natural language response inside the chat interface.

Building the Same Flow in a Custom Chatbot

Now let's see how a custom chatbot can implement the same approach using C#.

Step 1: Create an Authentication Service

Create a new class named AiAssistantAuthService.

Inside it, add a method named:

GetCalendarTokenOnBehalfOfUserAsync

Step 2: Register Your Application

Go to your Identity Provider's application registration portal, such as:

  • Microsoft Entra ID

  • Google Cloud

  • Facebook

  • Other OAuth providers

Register a new application for your AI Assistant.

Step 3: Configure the Identity Client

Create a confidential client using:

  • Tenant ID

  • Client ID

  • Client Secret

Use the user's existing access token (which the chatbot already possesses after login).

Most importantly, specify the required OAuth scopes, which define exactly what the AI is allowed to do.

Step 4: Request an OBO Token

Send the authenticated user's token to the Identity Provider and request an On-Behalf-Of access token.

Sample Code

using Microsoft.Identity.Client;

public class AiAssistantAuthService
{
    private readonly string clientId = "YOURAI_ASSISTANT_CLIENT_ID";
    private readonly string clientSecret = "YOURAI_ASSISTANT_CLIENT_SECRET";
    private readonly string tenantId = "YOURORGANIZATION_TENANT_ID";

    public async Task<string> GetCalendarTokenOnBehalfOfUserAsync(string incomingUserToken)
    {
        string authority = $"https://login.microsoftonline.com/{tenantId}";

        IConfidentialClientApplication app =
            ConfidentialClientApplicationBuilder.Create(clientId)
                .WithClientSecret(clientSecret)
                .WithAuthority(new Uri(authority))
                .Build();

        string[] scopes =
        {
            "https://graph.microsoft.com/Calendars.Read"
        };

        UserAssertion userAssertion = new UserAssertion(incomingUserToken);

        try
        {
            AuthenticationResult result =
                await app.AcquireTokenOnBehalfOf(scopes, userAssertion)
                         .ExecuteAsync();

            return result.AccessToken;
        }
        catch (MsalServiceException ex)
        {
            Console.WriteLine($"Error during OBO token exchange: {ex.Message}");
            throw;
        }
    }
}

Using the Generated OBO Token

After successfully generating the OBO token, the AI Assistant includes it in the Authorization header while calling APIs that expose personal data, such as:

  • Email

  • Calendar

  • Contacts

  • Files

The AI Assistant can then access only the resources and operations permitted by the token's assigned scope.

Why This Approach Is Secure

Using the OAuth 2.0 On-Behalf-Of flow provides multiple security benefits:

  • The AI never stores or knows the user's password.

  • The AI can never access data that the authenticated user cannot access.

  • Every API call is performed using a short-lived access token.

  • Permissions are limited to the requested scope.

  • Corporate security teams can audit every operation performed on behalf of the user.

  • Access can be revoked immediately by the Identity Provider without changing user credentials.

Summary

OAuth 2.0 On-Behalf-Of (OBO) Token Delegation enables AI assistants to securely access user resources without exposing passwords or granting unrestricted permissions. Instead of impersonating users directly, the AI exchanges the user's existing access token for a temporary, scoped token that is limited to specific APIs and permissions. This approach ensures least-privilege access, supports enterprise auditing, and allows AI assistants to safely interact with personal data such as calendars, emails, and files while maintaining strong security boundaries.

Membership not found