Someone asks Copilot to summarise what is known about last year's restructuring. The answer is tidy and properly cited. It also quotes a set of minutes that name the person asking and three colleagues, with figures attached.
Nothing was breached. At some point the site holding those minutes was opened to everyone in the organisation, because something needed sharing quickly. That was in 2023, and nobody ever changed it back.
Copilot breaks no permissions
Start here, because everything else follows from it. Copilot searches with the permissions of the person asking. What you cannot open does not appear in your answer.
That sounds reassuring. It is also the heart of the problem. The question shifts from "can the assistant see too much?" to "should this person have been able to see this all along?" In most organisations the answer to that second question has been "probably not, but it never mattered" for years.
Unfindability was the control
This is the mechanism, and it is worth stating precisely.
A large SharePoint tenant holds tens of thousands of documents. Some of them are far more open than they should be: a site once set to "everyone in the organisation", a folder that came across in a migration, a sharing link that never expired.
As long as you had to know where something was in order to find it, nothing happened. Search worked on keywords and rarely returned anything useful. In practice that was a security layer: never designed, entirely effective.
An assistant works differently. It searches by meaning, so you do not need the right words. It searches everywhere at once. And it summarises, so you do not even have to open the document to learn what is in it.
What changes is not access. What changes is effort. And if effort was your only control, you did not have one.
What surfaces
The categories are strikingly consistent across organisations:
- Pay and performance documents, often as an HR system export parked somewhere "for now"
- Restructuring and redundancy material, usually on a project site nobody cleaned up
- Board and leadership team minutes
- Contracts with unusual terms the rest of the business is not meant to know about
- Personal data in attachments to old tickets and requests
What they share: they are sensitive for good reasons, and nobody deliberately opened any of them up.
What Microsoft says about it
None of this surprises the vendor. Microsoft describes remediating oversharing as the first of three pillars in its own deployment guidance, ahead of setting up guardrails and ahead of meeting AI regulatory requirements.
The recommended sequence amounts to: identify the most-used sites, run a permission state report, start access reviews on the sites that are overshared and apply restricted access control to business-critical sites. Licences after that.
In practice it usually runs the other way round, because the licences arrived first and the cleanup is a project measured in months.
Why this is not an AI project
Perhaps the most useful conclusion is that none of this work is about AI. Permission cleanup was always necessary. It was simply never urgent.
What the assistant does is present the bill. Unwelcome, but useful: there has rarely been a better week to get an access review funded than the one in which somebody stumbled across their manager's salary letter.
The same pattern applies to any assistant that searches your own sources. See what RAG is and how AI tools reach files you never uploaded.
A second track runs alongside this project. Cleaning up permissions governs what the assistant can find inside your tenant. It does nothing about what someone pastes into a chat window from an email, a PDF or a system that was never in SharePoint at all. The two run in parallel, and only the first can ever be finished.
