AI should not change who can see what.

Your organisation spent years deciding who may read which files. An AI tool that answers from everything quietly undoes that work in a sentence.

Every organisation already has a permission model, even if nobody calls it that. The board papers sit in one SharePoint site, the salary review in another, the client contracts in a library only the commercial team can open. Someone set those boundaries on purpose, and someone maintains them every time a person joins, moves or leaves.

Now connect an AI assistant to all of it. Ask it a reasonable question (“what did we charge the last three clients for this kind of work?”) and it will happily answer from the contracts, the margin analysis and the email where a director explained the discount. The answer is useful. It is also, for most of the people who could type that question, a summary of material they were never allowed to open.

Leaks rarely look like leaks

Nobody downloads a forbidden file. Nothing trips an alert. The breach happens inside a paragraph of fluent prose, and the person reading it may not even realise which parts came from where. That is what makes it dangerous: an AI layer that indexes centrally and answers broadly becomes a permission bypass by default, not by design.

The usual responses don’t hold up. “We’ll only connect safe content” works until someone connects the wrong library. “We’ll tell people not to ask about sensitive things” relies on people knowing what is sensitive before they see it. “We’ll redact the answer for each user” sounds tidy, until two colleagues on the same project get different answers to the same question and neither can tell why.

The rule that holds

There is a simpler principle, and it survives contact with real organisations: AI may make permitted evidence usable, but it must never change who is permitted. Three practical consequences follow.

Answers respect the asker. When you ask a question, the evidence searched is the evidence you could already open yourself, checked at the moment you ask, not at the moment the content was indexed.

Shared spaces use the overlap. When a team works together, the evidence in play is what every member can see. If one person has access the others don’t, that source leaves the shared space; it is not quietly lent to everyone else.

Access is fixed at the source. If someone needs a document, they ask for it the normal way, through the people who own it. The AI layer never offers a “share anyway” button, because it was never the right place to grant access in the first place.

None of this makes AI less useful. Most good questions can be answered from what the asker is already entitled to see; the AI’s job is to find it, connect it and show its sources, not to widen the circle. An organisation that holds that line can let people use AI on real work without creating a new governance problem, because the boundaries it already maintains keep meaning what they meant. That is the difference between evidence-centric AI and a very articulate search box over everything.