Back to blog

AI

Permission-Aware AI: How to Stop Your AI Assistant From Oversharing

4 min read

Permission-aware AI answers each person only from the documents and records that person is already allowed to open. The finance analyst and the new intern can ask the same question and get different answers, because they can open different files.

It sounds basic. It is the most common reason company AI projects stall. A pilot goes well, someone asks the assistant about salaries or a pending acquisition, it answers, and the project is paused for a security review that takes six months.

This guide explains why it happens, what “permission-aware” has to mean in practice, and how to test any tool in an afternoon before you trust it with real documents.

Why AI assistants overshare

AI rarely creates a new leak. It finds the old ones.

  • Files shared too widely years ago. A folder shared with “everyone in the company” to get a project moving, and never closed.
  • Links anyone can open. “Anyone with the link” was the easy setting.
  • Groups nobody cleans. People change teams and keep their old access.
  • Copies. The board pack was restricted, but someone saved a copy in a shared drive.

Before AI, these mistakes were safe because nobody could find the files. A good assistant finds everything, in seconds, and summarises it nicely.

There is a second, quieter problem: when the tool checks permissions. Some tools first pick the best-matching documents from the whole company, then remove the ones the person cannot open. That order fails in two ways. If the removal step has a gap, it leaks. If it works, a person with narrow access often gets a short list or nothing, because the best matches were somebody else’s documents. Teams then widen access to “fix” the answers, and the first problem comes back.

What permission-aware has to mean

Use this as the definition when you compare tools:

  1. Permissions come from the source. Access in Google Drive, SharePoint, OneDrive, Confluence, Jira, Slack and Dropbox decides the answer. You do not rebuild it by hand.
  2. The check is part of the search, not a filter on the results. A document a person cannot open is never fetched for them.
  3. Changes apply quickly. When someone loses access, the AI stops using that document for them, without waiting for a nightly rebuild.
  4. Groups and single sign-on carry through. Your identity provider’s groups become access rules, and leavers lose access with their directory account.
  5. People outside the company are handled on purpose. Contractors see what was shared with them. Website and WhatsApp visitors get public knowledge only.
  6. Sensitive values can be masked. Card numbers, IBANs, phone numbers and your own patterns are hidden before the model reads them, with named people allowed to see the real value.
  7. Agents cannot act beyond their access. Reading is not the only risk: an agent that can send e-mail or update records needs approvals for those actions.
  8. Every answer is on the record. Who asked, what was used, what the agent did.

A 10-point test before you buy

Run this in a trial workspace with a few real (but not secret) documents.

  1. Make a document only you can open. Ask about it as yourself: the answer should use it.
  2. Ask the same question as a colleague: they should get nothing from that document.
  3. Share it with the colleague, then ask again: now they should get it.
  4. Remove the share: the answer should stop using it, soon.
  5. Put a file in a folder shared with one group. Test as a member and a non-member.
  6. Ask a question whose best answer is in a restricted file, as someone without access. Do they still get a useful answer from what they can see, or nothing?
  7. Ask as a guest or external user. What can they see?
  8. Ask from the website widget or WhatsApp. Only public knowledge should come back.
  9. Put a test card number in a document and ask about it. Is it masked?
  10. Check the audit trail for every test above. Is each question and answer recorded?

A tool that passes all ten is permission-aware. A tool that passes the first four and fails six is the “filter afterwards” design, and you will feel it as poor answers for anyone without wide access.

Fix the sharing too

Permission-aware AI shows you exactly what each person can reach, which makes it a good moment to clean up. Start with “everyone in the company” folders, public links and old groups. The AI will then be both safe and more useful, because answers come from documents that are current and owned.

Where promptev fits

promptev is a platform for sovereign AI agents for business. Agents answer from your company’s data, see only what each person may see, and ask before they act.

  • Permissions in every search. Access from your connected systems decides what each person’s answer may use. A document they cannot open is never fetched for them.
  • The same rule everywhere. The App, Slack, WhatsApp, your website, the API and AI tools over MCP all get the same check, with public knowledge only for visitors.
  • Masking, approvals and audit included. Built-in masking for common identifiers and your own patterns, approvals on every tool that writes or sends, and every run on the record.
  • Single sign-on and SCIM in every workspace, so your directory stays the source of truth.

You can start free with 1,000 credits and run the 10-point test yourself, or ask us to run it with you.

Frequently asked questions

What is permission-aware AI?

AI that answers each person only from the documents and records that person is already allowed to open in the source system. Two employees can ask the same question and get different answers, because they have different access.

Why does an AI assistant show documents people should not see?

Usually because the files were overshared long before the AI arrived: a folder shared with the whole company, a link anyone can open, an old team that was never removed. A search tool made those mistakes easy to find. Some tools also check permissions only after they have picked the best results, which can leak or return nothing useful.

Is permission-aware AI the same as role-based access control?

Not quite. Role-based access control decides what a person can do in the AI tool. Permission-aware AI decides which documents each answer may come from, using the permissions that already exist in Google Drive, SharePoint, Confluence and your other systems.

Does permission-aware AI work for people outside the company?

It should. Contractors, partners and customers should see only what was shared with them, and visitors on a public website or WhatsApp should get answers from public knowledge only. Ask any vendor how each of these is handled.

How do I test whether an AI tool respects permissions?

Create a test document that only one person can open, ask about it as that person and as someone else, then remove that person's access and ask again. A permission-aware tool answers the first person, refuses the second, and stops answering the first as soon as access is removed.