AI Governance Field Note
Who Can See What — The AI Access Question Every Manager Should Ask
Your new AI assistant is only as safe as the permissions behind it. Learn how cloud search indices surface forgotten files, and how to verify access controls before deployment.
The core challenge
Understanding who can see what across your connected data.
When an organisation connects AI assistants to internal cloud file storage, managers often worry about confidential information surfacing in routine prompts. AI search operates strictly under user identity, meaning it reads whatever the user already has permission to open.
In workplaces across New Zealand and Australia, managers are stepping up from individual tool usage to shared team capability. As tools like Microsoft Copilot and Claude Teams enter everyday business operations, the conversation shifts from prompt tricks to data governance.
The most common question managers raise during planning sessions concerns confidentiality. They want to know who can see what when an AI assistant searches across SharePoint libraries, Google Drive folders, or internal communication channels.
The technical reality is reassuring: modern enterprise AI search engines do not bypass user security. They operate under strict identity controls. If a user asks an assistant to retrieve recent financial forecasts, the system checks that user’s security token against the file index. If the user lacks permission to open the folder directly, the AI returns no results from those documents.
Why obscurity is no longer a security strategy
While AI engines respect permissions, they eliminate the safety net of obscurity. In many organisations, file folder structures develop over years. A folder created for a 2021 restructuring project might have been set to Everyone with Read Access because the team wanted quick collaboration.
When the project concluded, the folder remained in the cloud drive. Under traditional manual search, nobody found the files because nobody knew the precise subfolder path. Obscurity acted as informal protection.
AI search engines index every document piece by piece. When a staff member asks about historical team structures, the AI retrieves relevant text blocks from that forgotten 2021 folder. The AI did not create a security breach. It simply read a file that was left open to everyone. Aligning your internal folder review with New Zealand responsible AI guidance helps establish clear security standards.
Enterprise AI search acts as a mirror for your file permissions, surfacing the documents you forgot were open.
Zero to AI field note
Five questions to ask your IT team before deployment
Managers do not need to become systems administrators, but they must ask clear questions to confirm that file permissions match business expectations before launching connected search tools.
Auditing legacy open shares
Ask IT whether automated permissions scripts have scanned cloud storage libraries for broad Everyone or Domain Users access groups.
Sensitivity labels and encryption
Confirm if sensitivity tags apply restricted access controls to payroll records, executive correspondence, and legal files.
Guest and contractor access limits
Verify how external guest accounts interact with connected search, ensuring guest users cannot query internal libraries.
Audit logging and search histories
Ensure compliance logging tracks AI query activity, allowing security administrators to review potential over-sharing incidents.
Excluding sensitive sites from indexing
Check if executive or HR file stores can be temporarily excluded from AI search indexing while permissions are updated.
Practical steps for team leaders
To ensure a smooth rollout that supports AI training for mid-career professionals, complete these operational tasks before turning on connected assistants:
- Identify sensitive repositories: List all folders containing HR, finance, legal, or strategic decision documents.
- Review folder membership: Remove legacy guest accounts and restrict access to active role members.
- Conduct a test search: Use a standard team account to test queries and verify that confidential files remain hidden.
- Establish clear reporting: Give team members a direct channel to report unexpected document search results.
About the author: Steve Wilson is the founder of Zero to AI, a practical learning platform helping mid-career professionals across New Zealand and Australia build confident, safe AI workflows.
Build secure team capability
Get your AI data governance right from day one.
Zero to AI provides practical frameworks, podcast episodes, and step-by-step guides to help managers embed AI tools safely across their teams.