Who Can See What: The Access Conversation

Navigating the AI access conversation across your team.

When an organisation rolls out connected AI tools like Microsoft Copilot or Claude Teams, managers often express concern about data security. They worry that an employee asking a general query might see board papers, salary spreadsheets, or restructuring drafts.

Building shared team capability requires solving this trust problem upfront. Modern enterprise AI engines operate under strict identity controls. They do not bypass your cloud security. Instead, they index everything the individual user has permission to read, and bring forgotten over-sharing directly to light.

Why the access question matters now

In traditional file shares, poor folder hygiene stays hidden. A document saved in a general folder marked Everyone with Read Access might sit unnoticed for years because nobody knows the exact subfolder path. People rely on obscurity as a substitute for security.

Generative AI search eliminates the protection of obscurity. When a user asks an assistant to summarize recent project challenges, the system searches indexed content across the entire environment. If HR documents or commercial rates were saved in a shared site, the AI incorporates those text segments into its response.

The five-stage access review framework

To establish safe boundaries without stalling your deployment, work through these five logical stages with your business operations and IT leads.

Under the Hood: Permissions, Identity, and How Access Is Decided

To hold a confident conversation with your IT department, you need to understand the mechanism behind AI retrieval. In platforms like Microsoft 365, Copilot uses an API layer called Microsoft Graph. When a user submits a prompt, the system does not search a single massive file store. It sends an authenticated request on behalf of that specific user identity.

The Graph API checks the user’s Azure Active Directory security tokens. It queries the search index and filters out any document where the user identity lacks explicit read rights. If a user tries to ask about executive compensation, but the underlying SharePoint library limits access to executive group IDs, the search engine returns zero hits for those files. The language model never receives the text, so it cannot generate an answer based on that source.

The same principle applies in Claude Teams and custom enterprise connectors. Access is enforced at the index retrieval stage, long before text reaches the language model. When evaluating external compliance expectations, review the official New Zealand responsible AI guidance to align operational controls with public sector standards.

Five questions to ask your IT team before rollout

You do not need to configure the security settings yourself, but you should ask these direct questions to ensure your environment is prepared for AI training for mid-career professionals.

• How are we auditing legacy SharePoint or cloud drive permissions? Ask whether automated scripts have scanned for open link sharing or Everyone access groups across existing file libraries.
• Are sensitivity labels configured for confidential content? Confirm whether files containing personal information, financial forecasts, or HR records carry restricted encryption labels.
• How does the system handle external guest accounts? Verify that external contractors or temporary staff cannot query internal knowledge stores through connected AI search.
• What logging exists for AI search queries? Ensure that system logs capture query history so compliance managers can review potential data leakage events.
• Can we exclude specific sensitive sites from AI indexing entirely? Check if executive, legal, or HR repositories can be excluded from the global search index while permissions are cleaned up.

Practical steps for business leaders

Start by auditing your immediate team folder structure. Move archived HR reviews, contract disputes, and personal data into restricted libraries before turning on workspace-wide search features. Setting clean boundaries early protects organizational trust and allows your staff to adopt AI tools with full confidence.