Your employees can access it. Should AI use all of it?

Giving an employee access to information answers an important question: are they authorised to read it? Preparing that information for AI introduces another: which details does this particular task need?

That distinction deserves more attention before organisations widen an enterprise AI rollout. Access permissions are essential, but they do not establish whether every detail in an accessible collection belongs in every AI-assisted task.

Access is the starting point

Microsoft explains that Microsoft 365 Copilot works within existing permissions and highlights the importance of addressing oversharing. Organisations still need to review whether those permissions reflect intended access.

Even when access is correct, relevance and sensitivity remain separate considerations. A team member may legitimately read a client record without needing all of its contents in a briefing prepared for a wider audience.

A briefing does not need every detail

Consider an illustrative scenario: an account manager uses AI to prepare an internal client briefing. The available correspondence contains agreed actions, personal contact details and sensitive commercial discussions.

The briefing may need the actions, deadlines and named business owners. It may have no need for private telephone numbers or unrelated negotiation details. A useful preparation process identifies that distinction while preserving enough context to make the briefing accurate and useful.

The intended audience matters too. Information suitable for the account team may need different treatment before a summary is shared more widely.

Ask three separate questions

• Access: is this person authorised to use the information, and are the underlying permissions appropriate?
• Relevance: which sources and details does the task actually require?
• Sensitivity: which details should be excluded, masked or handled differently for this use case and audience?

These questions bring business owners, IT teams and delivery partners into the same discussion. They help define what a useful result should contain before the assistant is connected to a broader information collection.

Test one real business task

Before widening the rollout, select a representative workflow and agree its intended audience. Ask the information owner to identify the sources and details needed, together with any content that needs different handling.

Prepare an appropriate information set and test the resulting output. Check whether it includes the required facts, preserves their meaning and avoids unnecessary sensitive details. Review any omissions as carefully as unwanted inclusions: removing too much context can make an answer less useful.

Record the decisions, assign an owner and repeat the check when the information, audience or workflow changes. This makes information preparation a repeatable part of delivery.

Preparation complements access controls

Information preparation complements access controls. It does not replace them. AIAssure prepares enterprise information before AI uses it: Optimise makes information readable and removes duplicate and unnecessary files, while Cleanse identifies and removes personal and sensitive content.

Business owners still need to decide what is appropriate for the task, and teams need to test the results. For CIOs and AI delivery partners, the readiness question is: are we checking only what AI can access, or also what it should use?

Further reading: Microsoft 365 Copilot security guidance ↗
Adapted from Stewart Connors’ LinkedIn post. Read the original post ↗