Permitron: AI-Powered Task Management with Fine-Grained Permissions

This is a submission for the Permit.io Authorization Challenge: AI Access Control Permitron: AI-Powered Task Management with Fine-Grained Permissions Live Preview: https://permitron-app.windsurf.build/ Github Repo: https://github.com/Shaik-mohd-huzaifa/permitron Project Overview Permitron is an intelligent task management application that combines the power of LLM-based chatbots with Permit.io's robust permission management system. The application enables users to create, update, track, and manage tasks using natural language through a conversational interface, while enforcing strict permission controls based on user roles and context. Key Features Natural Language Task Management Create tasks via conversational commands: "Create a task for adding new feature" Update tasks: "Update task #123 with title: Improved API integration" Change task status: "Move task #123 to in-progress" Delete tasks: "Delete task #123" List tasks with filtering: "Show me my in-progress tasks" Kanban Board Visualization Visual task board with draggable cards Columns for Todo, In Progress, Review, and Done Status updates sync between chat and board interfaces Fine-Grained Permissions with Permit.io Role-based access control (Admin, Employee, Guest) Attribute-based permissions (task ownership, assignment) LLM operation authorization Chat Interface Integration Conversational AI powered by OpenAI Context-aware responses Permission-aware task operations Technical Architecture Frontend (React + TypeScript) React-based SPA with TypeScript Zustand for state management Tailwind CSS for styling Integrated chat interface and kanban board Backend (Node.js + Express) Express-based REST API OpenAI integration for natural language processing Permit.io SDK for authorization In-memory data store (could be replaced with a database) Permit.io Integration Permitron leverages Permit.io's powerful authorization system to implement fine-grained access controls for LLM-based task operations. Here's how Permit.io is integrated: 1. Resource-Based Authorization We've defined two key resources in our Permit.io configuration: resources: - key: task name: Task description: A task in the system attributes: - key: status type: string - key: assignedTo type: string - key: createdBy type: string actions: - key: create name: Create - key: read name: Read - key: update name: Update - key: delete name: Delete - key: change_status name: Change Status - key: llm name: LLM description: LLM functions actions: - key: manage_tasks name: Manage Tasks 2. Role-Based Permissions We've implemented different roles with varying levels of access: roles: - key: admin name: Admin permissions: - resource: task actions: ["create", "read", "update", "delete", "change_status"] - resource: llm actions: ["manage_tasks"] - key: employee name: Employee permissions: - resource: task actions: ["create", "read"] condition: "{ assignedTo: user.id } OR { createdBy: user.id }" - resource: task actions: ["update", "delete", "change_status"] condition: "{ createdBy: user.id }" - resource: llm actions: ["manage_tasks"] - key: guest name: Guest permissions: - resource: task actions: ["read"] 3. LLM Assistant Integration A unique aspect of our implementation is the integration of Permit.io with the LLM task processor. When a user asks the chatbot to perform a task operation, the system: Identifies the user's intent (create/update/delete/etc.) Extracts the task details from natural language Checks permission with Permit.io before execution Executes the task operation only if permitted Provides clear feedback about permission status Example code snippets showing this integration: // Check permission for task creation try { const permitted = permit ? await permit.check({ user: { id: userId, key: userId }, action: "create", resource: "task" }) : true; if (!permitted) { return { actionTaken: true, action: 'create_task', success: false, response: "❌ You don't have permission to create tasks." }; } } catch (error) { console.error('Permit.io check error:', error); } 4. Attribute-Based Access Control (ABAC) For operations on existing tasks, we use attribute-based permissions to check if the user is the creator or is assigned to the task: // For updating tasks permitted = await permit.check({ user: { id: userId, key: userId }, action: "update", resource: "task", context: { task: { createdBy: task.createdBy, assignedTo: task.assignedTo } } }); This

May 5, 2025 - 07:43

This is a submission for the Permit.io Authorization Challenge: AI Access Control

Permitron: AI-Powered Task Management with Fine-Grained Permissions

Live Preview: https://permitron-app.windsurf.build/
Github Repo: https://github.com/Shaik-mohd-huzaifa/permitron

Project Overview

Permitron is an intelligent task management application that combines the power of LLM-based chatbots with Permit.io's robust permission management system. The application enables users to create, update, track, and manage tasks using natural language through a conversational interface, while enforcing strict permission controls based on user roles and context.

Key Features

Natural Language Task Management
- Create tasks via conversational commands: "Create a task for adding new feature"
- Update tasks: "Update task #123 with title: Improved API integration"
- Change task status: "Move task #123 to in-progress"
- Delete tasks: "Delete task #123"
- List tasks with filtering: "Show me my in-progress tasks"
Kanban Board Visualization
- Visual task board with draggable cards
- Columns for Todo, In Progress, Review, and Done
- Status updates sync between chat and board interfaces
Fine-Grained Permissions with Permit.io
- Role-based access control (Admin, Employee, Guest)
- Attribute-based permissions (task ownership, assignment)
- LLM operation authorization
Chat Interface Integration
- Conversational AI powered by OpenAI
- Context-aware responses
- Permission-aware task operations

Technical Architecture

Frontend (React + TypeScript)

React-based SPA with TypeScript
Zustand for state management
Tailwind CSS for styling
Integrated chat interface and kanban board

Backend (Node.js + Express)

Express-based REST API
OpenAI integration for natural language processing
Permit.io SDK for authorization
In-memory data store (could be replaced with a database)

Permit.io Integration

Permitron leverages Permit.io's powerful authorization system to implement fine-grained access controls for LLM-based task operations. Here's how Permit.io is integrated:

1. Resource-Based Authorization

We've defined two key resources in our Permit.io configuration:

resources:
  - key: task
    name: Task
    description: A task in the system
    attributes:
      - key: status
        type: string
      - key: assignedTo
        type: string
      - key: createdBy
        type: string
    actions:
      - key: create
        name: Create
      - key: read
        name: Read
      - key: update
        name: Update
      - key: delete
        name: Delete
      - key: change_status
        name: Change Status

  - key: llm
    name: LLM
    description: LLM functions
    actions:
      - key: manage_tasks
        name: Manage Tasks

2. Role-Based Permissions

We've implemented different roles with varying levels of access:

roles:
  - key: admin
    name: Admin
    permissions:
      - resource: task
        actions: ["create", "read", "update", "delete", "change_status"]
      - resource: llm
        actions: ["manage_tasks"]

  - key: employee
    name: Employee
    permissions:
      - resource: task
        actions: ["create", "read"]
        condition: "{ assignedTo: user.id } OR { createdBy: user.id }"
      - resource: task
        actions: ["update", "delete", "change_status"]
        condition: "{ createdBy: user.id }"
      - resource: llm
        actions: ["manage_tasks"]

  - key: guest
    name: Guest
    permissions:
      - resource: task
        actions: ["read"]

3. LLM Assistant Integration

A unique aspect of our implementation is the integration of Permit.io with the LLM task processor. When a user asks the chatbot to perform a task operation, the system:

Identifies the user's intent (create/update/delete/etc.)
Extracts the task details from natural language
Checks permission with Permit.io before execution
Executes the task operation only if permitted
Provides clear feedback about permission status

Example code snippets showing this integration:

// Check permission for task creation
try {
  const permitted = permit ? 
    await permit.check({
      user: { id: userId, key: userId },
      action: "create",
      resource: "task"
    }) : true;

  if (!permitted) {
    return {
      actionTaken: true,
      action: 'create_task',
      success: false,
      response: "❌ You don't have permission to create tasks."
    };
  }
} catch (error) {
  console.error('Permit.io check error:', error);
}

4. Attribute-Based Access Control (ABAC)

For operations on existing tasks, we use attribute-based permissions to check if the user is the creator or is assigned to the task:

// For updating tasks
permitted = await permit.check({
  user: { id: userId, key: userId },
  action: "update",
  resource: "task",
  context: {
    task: {
      createdBy: task.createdBy,
      assignedTo: task.assignedTo
    }
  }
});

This enables contextual permission checks based on the task's properties and the user's relationship to it.

5. LLM-Specific Permissions

We've introduced a specific permission for using the LLM to manage tasks:

// Check if LLM can manage tasks on user's behalf
if (permit && !actionTaken) {
  const permitted = await permit.check({
    user: { id: userId, key: userId },
    action: "manage_tasks",
    resource: "llm"
  });

  if (!permitted) {
    return {
      actionTaken: true,
      success: false,
      response: "❌ You don't have permission to use the LLM for task management operations."
    };
  }
}

This adds an additional layer of control over which users can leverage AI for task management.

Benefits of Using Permit.io

Separation of Concerns: Authorization logic is cleanly separated from application code
Fine-Grained Control: Permissions based on roles, attributes, and context
Natural Language Understanding with Authorization: LLM understands not just what the user wants to do, but whether they're allowed to do it
User-Friendly Feedback: Clear permission-related responses from the chatbot
Scalable Permission Model: Easy to add new roles, resources, and permissions as the application grows

Future Enhancements

Implement user authentication with JWT integration
Add team-based permissions using Permit.io's tenancy model
Create an audit log of all permission decisions
Implement permission caching for performance optimization
Add permission-aware UI elements that hide/show based on user permissions

Conclusion

Permitron demonstrates how combining Permit.io's powerful authorization capabilities with AI-powered interfaces creates a secure, user-friendly task management system. By ensuring that the LLM understands and respects permission boundaries, we've created an application that leverages the power of AI while maintaining robust security controls.