Your AI assistant will find the folder everyone forgot was shared.

The search is new, the sharing isn't

Somewhere in your company's shared drive is a spreadsheet of salaries from a planning exercise a few years ago. Someone shared it with "everyone in the organization with the link" so a colleague could open it quickly, and then forgot. For years that was safe in practice, because finding it meant knowing it existed and knowing where to look.

An AI assistant that searches everything a person is allowed to open changes that overnight. Ask it "what do people on the design team earn?" and it may answer, correctly, with a citation.

It's worth being precise about what's happening. The assistant isn't leaking anything. It's showing you what your permissions have allowed all along. That's good news, in a way, because it means the fix is in a place you control. But it also means you should find out what's there before your staff do.

This walk-through is how we'd spend an afternoon doing that, before rollout or right after.

Pick a few people and a list of questions

You don't need to test as every employee. Three or four realistic roles will reveal most of the problems:

• A new hire in their first week, with default access.
• A team lead in one department.
• A contractor or agency partner, if they'll have access.
• Someone in a sensitive function, such as finance or HR, as a comparison.

Set up test accounts that mirror those roles exactly, or work with real volunteers who agree to help.

Then write twenty or so questions. Half should get good answers: the expense policy, how to request time off, the latest product pricing. The other half are the questions an over-curious colleague might ask:

• What do people in a given team earn?
• Who is on a performance plan?
• Are we planning layoffs, an acquisition or a reorganization?
• What are the terms in our contract with a named customer?
• What's the password for a shared account?
• What did the board discuss last quarter?
• Is there anything about a named colleague's health or leave?

The list should reflect your business. A healthcare provider, a law firm and a retailer will have different worst cases.

Ask as each person, and write down what comes back

For each role and each question, record four things: the answer, the sources it cited, whether that person should have been able to see those sources, and whether the answer itself revealed something even if the source wasn't shown. Summaries can leak. "I can't share the file, but it suggests the design team's salaries range from..." is still an answer.

Two extra tests are worth doing.

Remove access and ask again. Take one sensitive file, remove a test account's access to it, and repeat the question. Note how long it takes for the assistant to stop answering from it. Search indexes don't always update instantly, and you want to know the real delay in your setup.

Try indirect questions. People rarely ask "show me the salary file." They ask "how does my pay compare with others in my role?" Rephrase your sensitive questions a few ways.

At the end of the afternoon, you'll have a short list of findings. Most will trace back to a handful of causes.

Fix the source, not the assistant

The tempting fix is to tell the assistant not to discuss salaries. Don't rely on it. An instruction in a prompt is not a permission. It can be worked around with a clever question, it doesn't cover the next sensitive topic you didn't think of, and it does nothing about the person who opens the file directly.

Fix the underlying access instead:

• Narrow broad sharing links on sensitive files and folders, starting with the ones your test found.
• Review "everyone" groups and replace them with real teams where it matters.
• Clean up after departures and reorganizations, where old folders often keep old, wide access.
• Label sensitive content if your tools support it, so it can be handled differently.
• Move secrets out of documents. Passwords in a shared doc belong in a password manager.

This is a modeling question as much as a cleanup. In our work on Sutton|Place, access differs across the banking desk, the issuer and the internal operations team, and access to one part of an opportunity doesn't automatically expose every participant's position. Those rules live in the record itself. An assistant built on top of a system like that inherits sensible boundaries. One built on top of a shared drive inherits whatever the drive has accumulated.

Decide what the assistant should never index

Some content shouldn't be in the assistant's reach at all, whatever the permissions say, at least until it's been reviewed. HR case files. Legal matters, especially anything under a hold. Board materials. Raw exports of customer data.

Keep those repositories out of the index, and make that a deliberate, written decision with a named owner, not an accident of which connectors were switched on. Revisit the list when you add a new source. The question to ask about each connector is simple: if someone in our most junior role asked about anything in here, would we be comfortable with the answer?

It also helps to decide what the assistant is for. A tool that answers questions from approved policies and product documentation is far easier to secure than one that searches everything. We wrote about scoping that first in collect the questions before you index the documents.

Run the same test again after every change

Your question list and test accounts are now a test suite. Keep them. Run them again when you connect a new source, reorganize teams, onboard a new department, or change the assistant itself. Each run takes far less than the first, because you know what you're looking for.

Keep a record of who asked what, for security review, with the same care you'd give any log that may contain sensitive information. And make sure every answer cites its source, so people can check it and you can trace any surprise back to the file behind it. Our note on bounding the answer with a citation pack covers that.

We build AI applications that bring the right context into the moment, with sources, permissions and uncertainty visible. If you're about to switch on an assistant across your documents, or already have and are uneasy, let's run the test together.