AI for Engineering Knowledge Management
What an AI agent should return when PDM rights differ by person: three failure modes, three filtering designs, and six checks before you connect one.
·
⏱
8 min read
Dr. Maor Farid
Maor Farid is the Co-Founder and CEO of Leo AI, the first AI platform purpose-built for mechanical engineers. He holds a PhD in Mechanical Engineering and completed postdoctoral research at MIT as a Fulbright fellow. A Forbes 30 Under 30 honoree and former AI researcher and Mechanical Engineer in an elite military intelligence, Maor leads Leo AI's mission to transform how engineering teams design better products faster.
BOTTOM LINE
An AI agent on top of a PDM has to give each person exactly the answer that person could have found by hand: nothing extra, nothing missing. That means permissions must follow every derived copy of your data, filters must run before the model reads anything, and totals, counts, and citations must obey the same rules as files. Test with two accounts and a planted file before connecting anything, and ask the vendor in writing where the filter sits and how quickly rights changes take effect. If those answers are clear, an agent can make a restricted vault easier to use without making it less safe.
Ask a PDM a question and the answer depends on who is asking. A design engineer sees released and in-work files. A supplier quality contact sees a narrow slice of one program. A contractor might see a single folder. The vault has enforced those differences for years, one file open at a time.
Put an AI agent on top of that vault and the question changes. The agent does not open one file. It reads across thousands, summarizes them, counts them, and quotes them. This post looks at what a well-behaved agent should return when not everyone can see everything, where permission handling usually breaks, and the checks worth running before you connect one.
Why the same question has different answers in a PDM
A permission model in a PDM is rarely a single switch. Most systems combine several layers: who the person is, which group or role they belong to, which folder or project the file sits in, and what lifecycle state the file is in today. SolidWorks PDM, for example, lets administrators set permissions per user or group on folders, workflow states, and transitions. Autodesk Vault, PTC Windchill, Siemens Teamcenter, and Arena PLM each have their own vocabulary for the same idea, from role-based privileges to rule trees and policy domains. Check your own vendor's documentation for the exact model, because the details differ.
That layering is deliberate. A part in the Released state may be visible to purchasing and manufacturing, while the same part in Work In Progress is visible only to its designers. A program for a defense customer may sit behind a wall that even other engineers in the same company cannot cross. A supplier account might be limited to the drawings for parts they build.
Search inside the vault respects those rules because the vault itself answers the query: it filters results using the signed-in person's rights before anything is shown. We covered why that built-in search often disappoints in why engineers cannot find parts in their PDM. Its one advantage is that the vault stays the single authority. The moment an outside agent builds its own view of the vault, the agent has to reproduce that authority, and that is where things go wrong.
A useful test is simple. Take two people with different rights, ask both the same question, and check that each answer is exactly what that person could have found by hand. Anything extra is a leak. Anything missing is an answer the person was entitled to and did not get.
IN PRACTICE
It integrates directly with PLM and existing workflows, making past designs, standards, and calculations instantly available. The result is fewer errors, faster decision-making, and a more consistent process across teams.
- Sergey G., Board Member
Three ways an agent gets permissions wrong
Failures tend to fall into three groups, and the first one is the one that ends pilots.
Over-returning. The index is built with an administrator's credentials, so every file is searchable, and the agent answers everyone from the same pool. This is the most serious failure, and it is easy to ship by accident because it makes demos look excellent.
Under-returning. The agent is locked down so tightly, or its copy of the rights is so stale, that people cannot find files they are entitled to. They stop trusting the tool and go back to asking colleagues.
Leaking by inference. The agent never shows a restricted file but still reveals it: a citation title, a snippet inside a summary, a part count that includes hidden parts, or a sentence such as "there are two more documents you cannot open."
The third is the one teams forget. Restricted content can surface in derived forms, which is why it matters what an AI keeps when it reads your vault. We described those stored layers in what AI stores when it indexes your PDM vault. Every one of them, from text chunks to summaries to cached answers, needs to carry the same permissions as its source.
Timing adds a further wrinkle. Rights change daily: someone leaves a project, a file moves from Work In Progress to Released, a contractor's access expires. If the agent's picture of those rights is refreshed weekly, it answers today's question with last week's permissions.
What a good answer looks like for someone without rights
When a person asks about something they cannot see, the agent has a design choice, and there are three reasonable answers.
Silent omission. The agent answers using only what the person can see, as the vault's own search would. This is safe, but the person may believe the answer is complete when it is not.
Marked omission. The agent answers from visible files and says the answer may be incomplete because some sources are restricted, without naming them.
Access path. The agent says a relevant record exists and points to who can grant access, but only where the organization has decided that the existence of the record is not itself sensitive.
Which one fits depends on the data. For an export-controlled program, even the existence of a document can be sensitive, so silent or marked omission is safer. For an ordinary internal drawing, an access path saves days of searching.
Aggregate questions need the most care. Ask an agent for the total quantity of a fastener across an assembly, or the combined cost of a BOM, and the answer is built from many parts. If one subassembly sits behind a restriction, a total computed over only the visible parts is wrong in a way that looks right. The agent should either compute over everything the person is entitled to and say the figure is partial, or decline to give a total. A confident but partial number is worse than no number.
Citations follow the same rule. Every source an answer cites should be something the person can open. If the person clicks a citation and lands on an access denied page, the agent has already told them something it should not have.
How permissions travel from the vault to the answer
There are three common ways an agent can respect a vault's rules. Each carries trade-offs, and it is worth knowing which one a vendor uses.
Check at query time. The agent finds candidate files, then asks the source system whether this specific person may see each one. Rights are always current, but each question costs more time and depends on the vault being reachable.
Carry rights with the index. Each indexed chunk is stored with the groups and states that may read it, and results are filtered by the person's rights before anything reaches the model. This is fast, but only as fresh as the last sync of those rights.
Separate indexes per audience. One index for each group or program. This is simple to reason about and expensive to maintain when people belong to many groups.
Whichever design is used, the filter has to run before the model sees the content, not after. If a restricted passage is handed to the model and the model is told not to mention it, the control rests on obedience rather than enforcement. A prompt is not a permission system.
Two details are easy to miss. Group nesting matters: a person who inherits rights through three layers of groups must resolve to the same answer as in the vault. State changes matter too: when a file is released its audience often widens, and when it is superseded it may narrow. Ask how quickly those changes reach the agent, and how long a revoked right keeps working. For the wider picture of how agents connect to these systems in the first place, see how AI connects to PDM and PLM.
Checks to run before you connect an agent to a restricted vault
You can test most of this in an afternoon with a pilot vault and two accounts. Treat these as a minimum.
Create two test users, one broad and one narrow, and run the same ten questions as each. Compare the answers against what each person finds by hand in the vault.
Plant a distinctively named, harmless file in a restricted folder. Confirm the narrow user never sees it in a result, a citation, a count, or a summary.
Move that file from a restricted state to a released state, then back. Time how long the agent's behavior takes to follow.
Remove a user from a group and see how soon the agent stops returning that group's files.
Ask an aggregate question, such as a total quantity across an assembly with one restricted subassembly, and check that the answer flags itself as partial.
Ask the vendor in writing where the permission filter sits and who can read the index.
Leo offers integrations with leading PDM and PLM platforms, including SolidWorks PDM, Autodesk Vault, PTC Windchill, Siemens Teamcenter, and Arena PLM, and works as an intelligence layer on top of them, so your vault stays the system of record. Leo is SOC-2 certified and GDPR compliant, trains no AI on customer data, and protects customer intellectual property. How access rights are carried into answers is a question to settle for your own setup in a security review, so bring the checks above to it. The data-handling side is covered in what a no-training guarantee has to cover and SOC-2 for engineering AI.
FAQ
Ask us about access control
Book a demo and bring your hardest permissions question.
Leo is SOC-2 certified, GDPR compliant, and trains no AI on customer data. See how it sits on top of your PDM and PLM and cites the source behind every answer.
#1 New AI Software Globally - G2 2026
Enterprise-grade security
Trusted by world-class engineering teams
