“How much does my boss earn?” An uncomfortable question for a company AI. The crucial question is which documents the account making that request is actually allowed to read.
A potential failure starts long before AI arrives.
Imagine a fictional company with a salary spreadsheet in an old HR folder. During an earlier migration, the folder was shared with a general employee group. Nobody uses the link any more. The permission remains in place.
The company then introduces an AI knowledge search. If that source is connected, can be processed and is accessible to the requesting account, relevant passages may appear in an answer. No new security barrier needs to be breached. AI makes an existing permission error easier to discover.
This is a hypothetical example. It describes neither an actual DAXS customer incident nor behaviour guaranteed by any particular product. Without a suitable source and access to it, AI cannot reliably know the real figure; a number it produces anyway may be invented.
Three people, three different starting points.
The person responsible for HR may read the document for their work. Another employee lacks that permission, so their search must exclude the source. A third person has technical access because of the incorrect group share. In that case, the permission itself needs correcting. A prompt cannot reliably tell the model that this organisational decision was wrong.
A correct answer can still disclose the wrong information.
Many AI tests check whether an answer sounds right and is supported by documents. Confidential information requires another check: is this particular person allowed to see the evidence? An accurate salary figure can still disclose information that only a small group needs for its work.
Equally, a refused answer does not prove that protection is effective. The document may simply not have been found. Access tests therefore need to cover the source, search index, direct retrieval and indirect questions. A polite “This information is confidential” is not a dependable permissions test.
Commercial calculations need the same care.
The issue extends beyond salaries. An employee might ask about their billable hourly rate, a customer’s commercial terms or an internal project margin. These figures may appear in quotations and spreadsheets. Billing rate, contribution margin and company profit are different measures; a single retrieved number is not enough to calculate profit per hour responsibly.
Both source permissions and the quality of the conclusion need to be sound. Cleaning up confidential repositories and checking the accuracy of outputs are separate tasks.
What businesses can check before a pilot.
- Identify HR, finance and strategy documents and assign responsible owners.
- Review effective access, including groups, inherited permissions and sharing links.
- Prepare test accounts with authorised access, denied access and accidentally excessive access.
- Check that permissions are enforced before passages reach the model.
- Track revoked permissions through indexes, caches, exports and shared answers as well.
For Microsoft Copilot using Microsoft 365 data, Microsoft describes access within the user’s permissions. That makes correcting excessive existing access before rollout particularly valuable. Other chat products and additional agents require assessment of their specific data and account models.
A practical next step.
DAXS can plan a focused AI security assessment with a source inventory, permissions review and documented negative tests. The aim is a traceable starting point: which sources are available to which users, what gaps remain and who will address them?
The AI security and oversharing guide explains the controls. For the search architecture, Company knowledge & RAG provides further context.
Sources: Microsoft: data and permissions · OWASP: Sensitive Information Disclosure.
