Allow Apply Entity Access on GenAI function/tool microflows - Mendix Forum

Allow Apply Entity Access on GenAI function/tool microflows

0

When the GenAI connector executes a function/tool microflow, entity access is not enforced — regardless of whether "Apply Entity Access" is enabled on the microflow itself. The documented workaround of scoping XPath queries with $currentUser is inadequate: it only covers retrieval, not writes, it duplicates logic already declared in the domain model, and it silently breaks when an AgentAdmin wires up a tool microflow at runtime without understanding the implications.


The request:

Add an ApplyEntityAccess boolean to the Tools: Add Function to Request operation in GenAI Commons, and a corresponding setting in the AgentCommons agent builder UI. When enabled, the connector's internal execution loop should invoke the function microflow with entity access enforced.

asked
3 answers

Hi Bart,


sorry for the late response. We still cannot provide a native fix to the issue, because the root cause lies deeper than our modules. I understand that this is important for your use case and I can provide a solution in the meantime that you'd need to apply in the GenAICommons module. (this needs to happen every time you update the module from marketplace unfortunately)


To enable entity access inside a tool microflow, replace the standard getContext() call with a new user session context created from the current session.


In Java:

In the GenAICommons.Tool_ExecuteMicroflow java action you need to modify the executeAndLogToolMicroflow() method and change the passed context in two occurrences.

Instead of:


Core.microflowCall("MyModule.MyToolMicroflow").withParams(params).execute(getContext());


Do:


IContext isolatedContext= getContext().getSession().createContext();

// Execute microflow with isolated context, where ever Core.microflowCall() is used in Tool_ExecuteMicroflow

Core.microflowCall("MyModule.MyToolMicroflow") .withParams(params) .execute(isolatedContext);



What this does:

  • session.createContext() creates a new transaction attached to the same user session.
  • Entity access rules are now enforced inside the tool microflow if it is enabled in the microflow properties


Important Constraints

Because the tool microflow runs in a separate transaction:

  1. Non-persistent objects (like Request, UI state objects) created or modified inside the tool microflow are not visible to the calling context. They exist only within the isolated transaction.
  2. Uncommitted objects (persistent objects that were created or changed but not yet committed in the outer transaction) are also not visible inside the tool microflow.
  3. Changes to persistent entities made inside the tool microflow need to be committed in order to change after the tool microflow finishes.
  4. UI/view operations (opening pages, show-message, changing non-persistent UI state, refresh-in-client) executed inside the tool microflow are not visible to the user's live session.


As you see, there are quite some limitations with this approach. I'm curious to hear your thoughts!


Also feel free to reach out to our team, so we can have a discussion around this: genai-components-feedback@mendix.com


I hope this helps, sorry for the inconvenience.


Best,

Liam


Created

Hi Liam,


Is there any update on this?


Best,

Bart

Created

Hi Bart,


thanks for your suggestion.

We are aware of this limitation and are investigating how this can be best solved.

We already had a few approaches tested, but all had major downsides, so we decided to not move forward with them.


We're considering your option and will hopefully find a solution to tackle this problem.


Best

Liam

Created