Active Directory → permission for all _AI commands

Yes: command permission is enforced through Active Directory / enterprise policy, not only local settings.

How it works

You type a command
        │
        ▼
SpeechCommands → _ActiveDirectory::IsCommandAllowed(command)
        │
        ├─ App disabled by GPO?           → deny
        ├─ Domain required & not joined?  → deny
        ├─ Must be in RequiredADGroups?   → deny if not
        ├─ In FullAccessADGroups?         → ALLOW ALL categories
        ├─ Category in allow-list / *?    → else deny
        ├─ Category blocked?              → deny
        └─ Feature toggle off?            → deny
        │
        ▼
  Command runs

Emergency / ad / policy / safety commands stay reachable for diagnosis.

Grant “all commands” to an AD group

A. Domain operators (typical)

1. Create AD security group: AugmentedIntelligence_Operators.
2. Add operator user accounts.
3. Deploy ADMX from enterprise/admx/ (or set registry under GPO):

4. gpupdate /force, log off/on, start _AI.
5. Check:

ad full-access
ad authorize minecraft dqn eval
ad authorize nn access map

B. Local settings only

ad_group_requirement_enabled=true
required_ad_domain_group=CONTOSO\AugmentedIntelligence_Operators

That group is also used as full-access operators when GPO does not set FullAccessADGroups.

C. Environment

$env:AI_FULL_ACCESS_AD_GROUPS = "CONTOSO\AugmentedIntelligence_Operators"

Restrict some users (not full access)

• Put them only in a limited group listed in RequiredADGroups (if you use broader membership).
• Or set AllowedCommandCategories=minecraft;speech;memory without putting them in FullAccessADGroups.
• Or disable categories with EnableMinecraft=0, etc.

Related

• EnterprisePolicy.md — full GPO table
• ActiveDirectory.cpp — AuthorizeCommand / IsCommandAllowed
• enterprise/admx/AugmentedIntelligence.admx — Group Policy template

Skip for development only

set AI_SKIP_AD_CHECK=1

Do not use that on production operator workstations.