Notes · 5 of 8
A new hire gets an interview. An AI assistant gets a login.
What an AI assistant should be allowed to know about you and your organization, and why that decision is yours.
On a new hire's first morning, somebody hands them a badge.
A lot has been decided by then. Somebody read the resume, sat through the interview and called the references. Somebody decided to hire them. Somebody chose which doors the badge opens. From that morning on, they're a credentialed member of your organization, with a role and access to match.
An AI assistant can skip that morning, and all the vetting before it. One person connects it to your network, your email and the data your organization works to protect. Nobody interviewed it. Often nobody decided how much access it needs to be useful without becoming a risk.
A new reader with credentials
This is already happening. The email and document software most offices use now comes with an AI assistant built in: Microsoft Copilot in Outlook, Word and Teams, and Google Gemini in Gmail and Docs. ChatGPT and Claude can be connected to the same email and files. Once someone switches one on, it can read the documents and email that person can open, drafts and sensitive ones included.
Some of them don't stop at reading. These are usually called AI agents, and they act for you. Microsoft's Copilot Cowork, for example, can send email, post messages and create documents for the person using it. It can also start a task on its own when a matching email arrives. When I say "AI assistant" here, I mean both kinds.
Other software your office uses is adding the same access. A staff member can often turn it on without anyone signing off. I don't blame them. They are showing initiative and trying to get work done.
What a well-run assistant gives you
Done well, an assistant like this is worth having.
Picture the morning before a meeting with your voter registration vendor, or before a contract renewal. Your deputy asks the office's AI assistant which problems with that vendor are still unresolved, and how long each has been outstanding.
The answer comes back in a minute, inside the assistant they already use. Each line links to the email or file it came from, so they can open the source before they quote it. They see only what they are cleared to see. Their question is logged under their name, like any other access.
That is the pattern we use in our own work, the way we would onboard a person: a name, a short list of doors, and a record of every question.
If assistants don't go through the same access review as people, one can end up signed in under a login the whole office shares. Then private details from a personnel file can reach someone never cleared to see them. Nobody did anything wrong. Nobody decided anything either. That is how a helpful answer becomes a story.
Does your access policy cover agents?
Most access control policies were written for people, and for the service accounts IT manages. They say who gets an account, what each role can reach, and what happens when someone leaves. Here are four questions worth asking of yours, each with the situation behind it.
Whose identity does it use? An agent that answers a vendor from the shared office mailbox leaves no one's name on what it sent. One idea: tie every assistant to one named person, or give each agent its own identity with a named owner. Microsoft now does the second for agents built in its Copilot Studio.
What can it reach? An assistant sees what the person using it can see, including files that were shared too widely years ago. Microsoft's own example is a SharePoint site of budget files that turns up the moment an employee asks Copilot about budgets. If a staff member with ordinary access asked for "salaries" today, what would come back?
Which AI company handles what it reads? What an assistant reads passes through an AI company's systems. In July 2026, Microsoft added a setting that lets state and local customers on its government cloud use Anthropic's models in Copilot. It is off by default. Switched on, your data is processed in commercial cloud environments, outside the FedRAMP-authorized government cloud you signed up for. Does your vendor review ask that question about AI features?
What should no assistant read? The Election Assistance Commission's March 2026 guide tells election officials never to put individual voter registration information or internal security procedures into AI. A connected assistant can reach both without anyone typing them in. Personnel files belong on that list too, and on a campus, so do student records. Is that list written into your policy?
What only you can do
Treat an AI assistant the way you treat a new hire. You already control what each person can reach: which information, which systems, which doors. Hold an assistant to the same standard, including any that are already switched on.
Ask — what is connected today, and whose identity each one uses.
Copy and send: Please list every AI assistant and agent connected to our data and systems today, and the name each one signs in under. I'd like the list in writing by [DATE].
Send it to whoever runs your systems or governs access to your data. You want the whole list. Your systems team can see which outside apps staff have connected to your Microsoft or Google accounts. Expect the first list to be incomplete. That is part of the answer. This isn't about catching anyone. It's one more part of access control, and most offices already have a policy for that. If yours covers people, it should cover AI assistants too.
Decide — which of those four questions your policy answers today, and who will answer the rest, by when. Don't let an assistant follow a different set of rules than your staff.
Require — a record of every question asked through an assistant, under whose name, and when. No record, no connection.
Confirm — by reading it. Ask to see the record for one ordinary day. Look for names you don't recognize, and for questions about the facts your office is the authority on, like deadlines and procedures.
The short version, to forward:
Ask (what is connected today) · Decide (what your policy covers, and who owns the rest) · Require (a record of every question) · Confirm (read one day of it)
The first morning again
You already do this every time someone joins your office.
Give the assistant the first morning it skipped. A name, a badge, and a short list of doors. Then sign the list yourself.
No new hire gets a badge that opens every door. An AI assistant shouldn't either.
Sources
Microsoft, "Data, Privacy, and Security for Microsoft Copilot," Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy
Microsoft, "Restricted SharePoint Search" (the budget-site example), Microsoft Learn. https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search
Microsoft, "Manage Copilot Cowork for your organization," Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-admin-governance
Microsoft, "What are agent identities?" (Copilot Studio agents), Microsoft Learn. https://learn.microsoft.com/en-us/entra/agent-id/what-are-agent-identities
Microsoft, "Anthropic operated models for non-federal customers in GCC," Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365/copilot/anthropic-non-federal-gcc
OpenAI, "Introducing company knowledge." https://openai.com/index/introducing-company-knowledge
Anthropic, "Use Google Workspace connectors," Claude Help Center. https://support.claude.com/en/articles/10166901-use-google-workspace-connectors
U.S. Election Assistance Commission, "AI in Action: Case Studies for Election Officials," March 2026. https://www.eac.gov/sites/default/files/2026-03/AI_Case_Studies_508.pdf