The fastest way to lose trust in a company AI assistant is for it to answer a new employee’s question with a paragraph from the board minutes.

It happens more easily than people expect. An assistant that searches company documents usually runs under one service account that can read almost everything. If it checks permissions at all, it often does so after it has already fetched the text, and only hides it from the final answer. The text has still passed through the model, and a clever question can bring it back out.

Permissions are applied inside the search

When we design an assistant for a company, we copy each document’s permissions from the system that holds it: the shared drive, the document library or the mailbox. Those permissions travel with the document into the search index.

When someone asks a question, the assistant searches only the documents that person may open. Anything else is never fetched, so the model never sees it. The answer then cites the passages it used, and the person can open the original document from there.

When permissions change in the source system, or a document is deleted, the change reaches the assistant too. Removing access takes priority over adding new content.

The assistant acts with the person’s own permissions

The same rule applies when the assistant does something, such as opening a support ticket or updating a customer record. It uses a short-lived permission that belongs to the person it is working for and covers that one action. It can never do more than that person could do in the system directly.

This also limits the damage from documents that carry hidden instructions. Text inside a document or an email is treated as information to read, and it cannot give the assistant new tools or wider access. Anything beyond the assistant’s limits goes to a named person for approval, as we described in Five layers, with a security control at each one.

Groups with several companies

A group with several companies has one more question: can one subsidiary’s assistant see another subsidiary’s files? By default, no. Each company has its own space, administrators and budget, and sharing between companies is something both sides switch on deliberately and can switch off again. When a group-level question spans several companies, the answer says which ones were included and which were not.

When the source has no permissions

Some older systems do not record who may read what. In that case we treat the content as restricted until an administrator decides who should see it. It makes the start slower, and it is the only safe default.

Questions to ask any vendor

  • Are permissions applied before the search, or only before the answer is shown?
  • Whose identity does the assistant use when it changes a record?
  • How long does it take for a removed permission to reach the assistant?
  • What happens to documents whose source system records no permissions?
  • In a group, how is one company’s data kept away from another company’s assistant?

Related pages