Confidential knowledge.
Carefully protected.
AI makes knowledge easier to find. DAXS reviews data flows, access rights and tools so that company knowledge is used within the agreed business and technical permissions.
AI can disclose too much without bypassing an access restriction.
Company AI can make documents easier to find even when few people previously knew they existed. That becomes a problem when more people can access the source than the business intends. AI oversharing in this context means unintended disclosure caused by overly broad permissions and easier discovery. An answer can be technically permitted yet still be inappropriate for the organisation.
The service, connected sources and identity used for retrieval determine what can be accessed. A chat without connected data cannot simply search every company folder. Uploading files, connecting search indexes or authorising tools creates a data flow that needs a traceable review.
“How much does my manager earn?”
Hypothetical example: a salary file is stored in an old HR folder. An inherited group permission also gives employees outside HR read access. If the AI service has indexed the file and the query is permitted under those rights, relevant content can appear in an answer. An incorrect figure or an invented answer is also possible; each specific output needs supporting source evidence.
With correctly restricted permissions, the protected file must be excluded from the model context for unauthorised users. Asking the model to keep salaries secret does not replace this technical control.
Three people ask the same question.
A needs the information for an authorised task. B has no read permission. C has unintended access because of a permission error. The system must exclude B; for C, the incorrect permission at the source needs to be corrected.
The diagram shows different access situations, rather than three successive steps. The retrieval service also needs to handle changes: revoked access must not persist through outdated index permissions, answer caches, shared conversations or exported files.
Hidden, encrypted and protected describe different properties.
- Navigation and access
- Hiding a menu item or using an unfamiliar folder name does not revoke read permissions. Access control must apply to the object and the service used, including direct URLs, searches and API requests.
- Inheritance and sharing
- A document can inherit permissions from parent folders, groups, individual shares or links. The review covers effective access through all these routes; checking one group list is insufficient.
- Index and original
- A search result does not grant a new permission. Search indexes, document excerpts, titles, previews and access to the original all need appropriate controls. Even a result title can otherwise disclose confidential information.
- Encryption and authorisation
- Encryption can protect data in transit and at rest. Permission to read data through the application is a separate decision. A service account authorised to decrypt content must therefore not disclose it to every signed-in user.
- User and agent
- An agent can act with delegated user permissions or its own service identity. Both approaches need explicit boundaries. A shared agent with a powerful account must not bypass its users’ permissions.
- Internal and external services
- Internally hosted AI also needs source permissions, protected logs and secured interfaces. External connectors add questions about data recipients, contractual arrangements, processing, storage and permitted actions.
Which information should be discoverable together?
“What hourly rate does the company charge for my work?”
Quotes, project calculations and spreadsheets can contain billing rates and internal cost figures. These values mean different things: the billing rate is the price charged to the customer. A contribution margin can only be calculated once the costs to be deducted have been defined. Company profit comes from the full income statement. AI must not equate these figures or derive an apparently precise answer from a single number.
Before connecting these documents, the responsible people decide who may see each calculation. Test questions need to include indirect requests about customer discounts, purchasing terms and individual project margins, alongside direct questions about prices.
The forgotten project folder
A completed project disappears from the portal but remains readable by a broad group. If documents are still imported or discoverable through a connector, AI can use relevant content. The appropriate response is a reviewed decision about archiving and permissions; removing a navigation link is insufficient.
HR decisions and strategy
Planned staffing changes, acquisition discussions, revenue targets, investments and profit forecasts can be spread across different repositories. The review therefore starts with information classes and responsible owners. An “internal” storage location does not establish which department needs each piece of information.
Check product capabilities and correct permissions at the source.
For Microsoft Copilot services using Microsoft 365 data, Microsoft describes retrieval within each user’s access permissions. Overly broad read access therefore remains a deployment risk. The name “Copilot” alone does not define licence entitlements or data access; chat, application context and additional agents need separate consideration. Microsoft: data and permissions (external link) — opens in a new tab.
Sharing and governance
SharePoint Advanced Management helps review problematic access. Microsoft Purview provides capabilities including classification, sensitivity labels, DLP and auditing. Available controls and the data flows they cover depend on licensing, configuration and the current product.
Limit discoverability
Restricted Content Discovery can limit organisation-wide search and Copilot discovery for selected SharePoint sites. It does not change existing access rights and therefore cannot replace access restrictions for confidential files. Direct access and exceptions also need to be tested.
Update outdated recommendations
Restricted SharePoint Search is being retired. Microsoft states that new activation has been blocked since 31 July 2026. A new deployment should not base its long-term security architecture on this feature.
For ChatGPT with connected services, it must also be clear which account authorises the connection and what data access and action permissions it holds. A managed workspace organises responsibilities; it does not correct a misconfigured share in the source system. For a custom RAG solution DAXS explicitly includes identity, permission filters and updates in the architecture.
Only authorised information reaches the model.
- Information classes and owners: HR, finance, projects and public knowledge each need an appropriate audience and responsible owners.
- Least privilege: Users, applications and service accounts receive only the permissions they need. RBAC assigns permissions to roles; ABAC can also consider attributes such as document classification, organisation or project membership.
- Permission-aware retrieval: The application establishes a trustworthy identity. Security trimming or permission-aware retrieval limits results and excerpts before they reach the language model. A group name taken from a prompt is not proof of identity.
- Changes and caches: New shares, revoked permissions, deleted sources and group changes need to be reflected in the system. Answer caches must not mix data belonging to different users or tenants.
- DLP and protection policies: Permitted sharing, uploads, downloads and external recipients need separate checks. A label is effective only when supported enforcement has been configured for it.
- Negative tests and auditing: Test accounts without permissions, direct and indirect questions, source changes and manipulated documents belong in acceptance testing. Logs retain the necessary evidence with restricted access and appropriate retention.
Sensitive information disclosure and data leakage extend beyond the visible answer: search logs, error messages, exports and shared chats can also contain confidential information. The security review follows the complete data flow.
Tool permissions and approvals limit potential harm.
For an agent, correct retrieval permissions alone are insufficient. An overprivileged service account could change or send data that the requesting employee cannot edit. DAXS therefore separates read tools, proposed changes and actual execution. APIs and MCP servers validate the object, identity, input and permitted action in the target system.
Prompt injection can introduce new instructions through external documents or tool results. That content remains data. Critical actions need a verifiable approval covering the destination, scope and a preview of the result. Limits on steps, execution time and costs, together with an abort mechanism, provide further controls. These measures address OWASP risks including Prompt Injection, Sensitive Information Disclosure and Excessive Agency; they do not guarantee that every risk is eliminated.
An AI security review with a verifiable scope.
DAXS can support the introduction of Copilot, ChatGPT or custom AI through clearly scoped project components: a source and account inventory, permission matrix, data flow, sampling of problematic shares, a controlled pilot and documented negative tests. The result is a prioritised action list with owners and clear acceptance criteria.
Operations include changes to groups and connectors, model and software updates, security advisories, repeated permission reviews and a process for handling unusual outputs. Technical work is coordinated with the necessary data protection and organisational assessment. A particular configuration is not general proof of GDPR or AI Act compliance.
For everyday use, AI in the workplace covers introduction and training. AI cost optimisation connects security requirements with economical model selection.
Let's discuss your use case.
Which task should become easier, what data is involved and which systems do you already use? This defines a bounded starting point with clear review and decision stages.
Sources: Microsoft: data and permissions (external link) — opens in a new tab · Restricted Content Discovery (external link) — opens in a new tab · Restricted SharePoint Search: retiring feature (external link) — opens in a new tab · Purview (external link) — opens in a new tab · OWASP: Sensitive Information Disclosure (external link) — opens in a new tab · OWASP: Excessive Agency (external link) — opens in a new tab
Product features, licences and specific settings are assessed for each environment. Examples and diagrams explain possible workflows.