An Azure-hosted portfolio project demonstrating how an organisation can give staff useful answers from approved documents without allowing an AI system to bypass access controls.
The application checks identity and role permissions before retrieving information. It then produces one of three controlled outcomes:
- a grounded answer with a source citation;
- an access-denied response with no restricted-content leakage; or
- a safe refusal when authorised evidence is unavailable.
Data statement: every document, role and scenario in this repository is synthetic and fictional. No real employee, customer, payroll, cultural or operational information is used.
Organisations want the productivity benefits of AI, but their documents do not all have the same sensitivity. A useful knowledge assistant must respect existing permissions, explain where an answer came from and avoid inventing information.
This project demonstrates those controls in a working application that can run locally or as an identity-protected Azure service.
- Identity-based access: the Azure deployment uses Microsoft Entra ID sign-in and assigned application roles.
- Authorisation before retrieval: documents outside the trusted role are filtered before their content can be used.
- Least privilege: seniority does not automatically override specialist controls; highly confidential payroll guidance remains finance-only.
- Grounded responses: supported answers include the source passage used.
- Safe denial: unauthorised requests return no restricted citation or content.
- Safe uncertainty: the assistant declines when reliable evidence is missing.
- Passwordless Azure access: managed identity accesses private Blob Storage without committed keys or passwords.
- Portable design: document and answer providers can be replaced without rebuilding the core access rules.
flowchart LR
U[Staff user] --> E[Microsoft Entra ID]
E --> A[Azure App Service<br/>FastAPI application]
A --> I[Trusted identity and role]
I --> C[Access-control check]
C --> R[Authorised retrieval<br/>and passage ranking]
R --> B[(Private Azure<br/>Blob Storage)]
R --> G[Grounded answer service]
G --> O[Answer with citation<br/>Access denied<br/>Evidence unavailable]
M[User-assigned<br/>managed identity] -. passwordless access .-> B
K[Azure Key Vault] -. secure configuration boundary .-> A
F[Future adapters:<br/>SharePoint / Microsoft 365 /<br/>approved AI provider] -. replaceable integration .-> A
The application has two intentional operating modes:
- Local demonstration mode - a visible persona selector makes access behaviour easy to demonstrate.
- Azure Entra mode - the user cannot select a role; the API accepts the trusted role from the authenticated Microsoft Entra identity.
| Document category | Employee | Manager | Senior executive | Specialist access |
|---|---|---|---|---|
| Public and internal guidance | Yes | Yes | Yes | Yes |
| Management planning | No | Yes | Yes | No |
| Restricted HR procedure | No | No | Yes | HR only |
| Restricted IT procedure | No | No | Yes | IT only |
| Restricted finance summary | No | No | Yes | Finance only |
| Highly confidential payroll review | No | No | No | Finance only |
The seven-document knowledge base is deliberately small and invented so the security decisions remain easy to inspect and test.
- Application: Python, FastAPI, HTML, CSS and JavaScript
- Identity: Microsoft Entra ID and application roles
- Azure: App Service, Blob Storage, Key Vault and user-assigned managed identity
- Infrastructure: Azure Bicep and Azure CLI
- Quality: pytest and GitHub Actions continuous integration
- Architecture: ports and adapters with replaceable repositories and answer providers
The final test suite contains 102 automated tests covering:
- access-control decisions and hierarchy;
- authorised and unauthorised answer outcomes;
- Entra identity parsing and trusted-role enforcement;
- API contracts and presentation-interface behaviour;
- local and Azure document repositories;
- safe file paths, chunking and retrieval relevance;
- runtime security and production identity requirements.
Run the checks locally:
python src/validate_data.py
python -m pytestExpected result:
Dataset validation passed: 7 synthetic documents.
102 tests passed.
- Create and activate a Python virtual environment.
- Install the dependencies:
python -m pip install -r requirements.txt- Copy
.env.exampleto.envand keep the safe local defaults:
APP_ENVIRONMENT=development
IDENTITY_MODE=demo
DOCUMENT_REPOSITORY=local
- Start the application:
python -m uvicorn src.api:app --host 127.0.0.1 --port 8000- Open:
http://127.0.0.1:8000- business-friendly demonstration interfacehttp://127.0.0.1:8000/docs- interactive API documentationhttp://127.0.0.1:8000/health- health endpoint
- Ask a general security question as an employee and show the cited answer.
- Ask an HR question as an employee and show the access-denied response.
- Repeat as an HR adviser and show the authorised answer.
- Ask for payroll guidance as a senior executive and show that hierarchy does not override finance-only confidentiality.
- Repeat as a finance officer and show the grounded payroll answer.
- Ask an unsupported question and show the evidence-unavailable response.
See docs/demo-guide.md for the complete walkthrough.
The current answer provider is deterministic and extractive. It does not call an external large language model. This keeps the portfolio demonstration predictable, inexpensive and auditable while proving the access, retrieval and deployment architecture.
The provider interface is intentionally replaceable so a future approved enterprise AI service can be introduced behind the existing identity, authorisation and evidence controls.
docs/access-control.md- roles, hierarchy and document permissionsdocs/final-architecture.md- completed system designdocs/generation-safety.md- grounded-answer and prompt-boundary safeguardsdocs/azure-governance.md- naming, tagging and cost controlsdocs/azure-secure-services.md- storage, identity and Key Vault designdocs/api-and-azure-adapter.md- API and repository integrationdocs/demo-guide.md- presentation walkthrough
These materials provide a quick, non-technical overview of the completed project:
- Architecture overview — explains the identity, access-control, retrieval and answer flow.
- Architecture diagram — recruiter-friendly visual summary.
- LinkedIn carousel — PDF — five-slide project overview.
- LinkedIn carousel — editable PowerPoint — editable presentation source.
- Demonstration recording script — structured four-minute walkthrough.
- Public repository security review — completed review and recommended security improvements.
- Security policy — private vulnerability-reporting guidance.
Completed:
- Entra-protected Azure App Service deployment;
- private Azure document repository and passwordless access;
- role hierarchy and specialist restrictions;
- automated security and behaviour tests;
- recruiter-friendly web interface and documentation.
Future extensions:
- Microsoft SharePoint document adapter;
- Microsoft 365 integration;
- an approved enterprise AI answer provider;
- central monitoring, audit reporting and consumption controls;
- formal security, privacy and responsible-AI review before any real-data use.
Janith Weerakkody
AI and Data Specialist | Darwin, NT
Guided access to the identity-protected Azure demonstration is available on request.