Michelle DaSilva
SecureAccess:
AI-Powered
Permission Management.
A product design concept — an AI assistant for small business owners to manage user permissions with confidence. Guided setup, smart suggestions, and proactive security controls, with business owners firmly in charge of every decision.
Overview
A Concept Design from ASM Research
SecureAccess is a concept design built from ASM research insights, showing how I translated permission management research into a complete service architecture centered on AI-assisted decision-making. It was never shipped to production at JPMorgan Chase, but it's a full design hypothesis — backed by real research and strategic reasoning about how to make humans confident decision-makers when working alongside AI.
Executive Summary
The Problem and the Opportunity
- Guided setup — step-by-step, role-tailored recommendations
- Smart suggestions — AI-driven, prevents over-permissioning
- Security alerts — proactive risk flagging and error checks
- User control — final decisions always stay with the owner
The Problem
Permissions Everywhere, Guidance Nowhere
As a business owner, I need a streamlined and intuitive way to assign permissions to my employees that align with my business needs while maintaining robust security. The current process is often overwhelming and lacks clear guidance, leaving me uncertain about making the right choices. Notifications are difficult to manage and fail to provide timely, actionable information. Consequently, I either grant excessive permissions or handle tasks myself — leading to inefficiencies and increased workload.
What was needed was more than a cleaner interface — clear, step-by-step guidance, AI-driven suggestions, and robust security features, all while keeping user control and transparency intact.
Market Context
AI Is Transforming Financial Services — Permission Management Is Next
The data showed a clear case for AI-driven assistance in permission management. Three measurable outcomes from adjacent financial AI deployments confirmed the opportunity:
User Research
Five Insights That Shaped the Design Direction
Research with small business owners surfaced five consistent themes — each one directly informing a design decision, from the AI suggestion model to the transparency and control mechanisms built into SecureAccess.
Secondary Research
Industry Signals and Competitive Context
Secondary research surfaced industry trends and competitive signals that shaped the design direction — and revealed opportunity areas that user interviews alone wouldn't have uncovered.
- AI in Financial Services: AI is increasingly used in banking for fraud detection and customer service, but its application in user permission management remains limited — presenting a clear opportunity to lead.
- User-Centric Design: Financial tools are increasingly designed for simplicity and control, aligning with the need for intuitive permission management that business owners can confidently navigate.
- Personalized Recommendations: AI can tailor permission suggestions based on business type and employee role — reducing cognitive load and enhancing decision accuracy.
- Proactive Security: AI can identify and flag security risks early, providing peace of mind and reducing unauthorized access before it occurs.
- Integration with Tools: AI can streamline management by integrating with platforms like QuickBooks and Xero — reducing manual reconciliation work.
- Multi-User Management: Managing users across multiple platforms and account types is complex, leading to security risks. A unified solution could address this directly.
- Real-Time Alerts: Users need timely alerts and actionable insights to improve security and make informed decisions — not after-the-fact summaries.
- Transparency: Clear communication about how AI processes work builds trust and encourages adoption. Users who understand the system are more willing to rely on it.
- Feedback and Improvement: Regular user feedback helps refine the product to meet evolving needs — and signals to users that the system is listening.
Current State
The ASM Experience, Mapped End to End
Before designing the future state, we mapped how the Access & Security Manager experience actually worked — end to end, across every touchpoint and behind-the-scenes process. This current-state blueprint surfaced where users got lost, where the system provided no guidance, and where the gaps between frontstage and backstage created the permission complexity owners struggled with daily.
Strategic Reframe
The Pivot: From Complexity to Confidence
Initial research showed permission management was overwhelming — but that was a symptom, not the root cause. Digging deeper revealed a more fundamental problem that changed everything.
This reframing changed the entire design approach. We stopped optimising for fewer steps and started designing for informed confidence — ensuring every AI touchpoint made owners feel more capable, not less in control.
Design Constraints from Research
Context
Permission Management at Scale
This concept addresses a real product gap at scale. The ASM experience serves 8.7M small business customers — and the permission management problem the research surfaced isn't an edge case, it's the default experience for most of them.
The Solution
SecureAccess: Smart, Secure, and Simple
An AI-powered assistant that helps business owners confidently and efficiently assign the right permissions to users.
SecureAccess is embedded in the bank's Access & Security Manager — guiding business owners through every step of permission management with personalized recommendations, real-time security monitoring, and full user control at every decision point.
Expected Benefits
What SecureAccess Delivers for Business Owners
Every feature maps directly to a pain point uncovered in research — reducing risk, workload, and uncertainty while keeping the business owner firmly in control.
Key Features
Five Core Capabilities, Each Grounded in Research
Five core capabilities — each mapped directly to a research insight — that make the right permission decision the obvious one.
Interface Design
Access & Security Dashboard
A complete overview of user management and access control — real-time alerts, in-context AI guidance, and account activity designed to be actionable, not just informational.
Mockups generated using Motiff AI (2025, now discontinued) — AI-prompted design used to rapidly explore and communicate concepts during early product exploration.
User Flow
A Four-Step Guided Experience
The AI-assisted flow breaks the complex task of adding a new user into four clear, manageable steps — with AI suggestions available at every stage and full user override at any point. The goal: make the right choice obvious, not just possible.
Add a User
Collect basic user details and let AI suggest the best role based on job description and business type. The AI considers industry norms and past patterns — so the suggestion is informed, not generic.
- User information form
- AI role suggestion panel
- Option to turn off AI suggestions
Select Accounts
Choose which accounts the user will have access to, with AI-driven recommendations based on role and industry best practices. Each recommendation comes with a "Why this?" explanation — no black box.
- AI account recommendations
- "Why this?" transparency feature
- Manual override available
- Proactive security tips
Set Permissions
Define role and permissions with AI highlighting potential security risks and explaining what each permission entails. Over-permissioning is flagged before it's committed — not after.
- Predefined role templates
- AI-suggested permissions
- Permission risk detection
- Scenario-based guidance
Review & Confirm
Full summary view with AI security insights before confirmation — and the option to edit any step before finalizing. The AI provides a final assessment so business owners can confirm with confidence, not guesswork.
- Complete access summary
- AI security assessment
- Edit at any prior step
- Confirmation email sent
Responsible Design
Ethics Review of this AI Assistant: SecureAccess
Deploying AI in financial decision-making introduces meaningful ethical obligations. Each concern was addressed through deliberate design choices — woven into the product architecture from the start, not treated as an afterthought.
- Final decisions always remain with the business owner
- AI suggestions are clearly labeled as optional and overridable
- Scenario-based guidance helps users make informed choices
- "Why this?" feature explains the logic behind every suggestion
- Visual diagrams show the full access picture
- Regular updates communicated through the notification system
- Robust encryption and secure authentication protocols
- Clear communication of data protection measures
- Proactive security tips to enhance user confidence
- AI balanced with full manual override at every step
- Explanations encourage critical evaluation of suggestions
- Education resources accessible throughout the flow
- Regular audits of AI algorithms for bias and accuracy
- Diverse training data across business types and industries
- User feedback loop to continuously improve fairness
Action Plan
How Each Risk Was Addressed
Five targeted interventions translate the ethical considerations above into concrete product commitments — each addressing a specific failure mode in AI-assisted financial tooling.
Design Reflection
What This Concept Demonstrates
- AI should augment judgment, not replace it. Business owners need to feel authorship over every permission decision — the moment they feel bypassed, trust collapses. Every design choice here was in service of that.
- Transparency is a prerequisite, not a feature. Users who don't understand why an AI suggestion exists will distrust the entire system. "Why this?" isn't a nice-to-have — it's what makes the AI usable at all.
- Phased rollout is how you earn the right to expand AI responsibility. Starting with monitoring-only and graduating to predictive features isn't just risk management — it's the only honest way to introduce AI into a high-stakes workflow.
Strategic Roadmap
Define → Design → Deliver
SecureAccess is structured with a phased rollout that minimizes risk while building confidence in AI-assisted decisions — beginning with monitoring-only, gradually introducing Accept/Edit/Decline controls, then expanding to predictive features. This sequencing matters: you earn the right to expand AI responsibility, you don't assume it.
