An AI assistant will find everything you ever overshared

A company switches on an AI assistant that can search across its documents, mail and shared drives. In the first week a junior employee asks it, half as a joke, what the sales team earns. It answers, accurately and with a tidy summary, from a spreadsheet in an HR folder that has been shared with the whole organisation since a reorganisation three years ago.

Nobody broke a rule. The employee had permission to open that file all along. They simply never knew it was there.

That is the real cause, and it is uncomfortable. For years the actual access control in most company file shares has been obscurity: people could not find what they were not supposed to see. An assistant that searches everything the user is allowed to open removes the obscurity overnight. The permissions were always wrong. The assistant just reads them literally.

Where the exposure hides

Organisation-wide sharing. Sharing a folder with everyone in the company was the quick fix for a missing permission one busy afternoon. It was never undone, because nothing broke.

Inherited permissions. A folder moved into a broadly shared parent quietly picks up the parent’s access. Nobody reviews permissions after a move, because the move felt like housekeeping.

Orphaned spaces. Project sites and team folders whose owners left years ago. Still shared, still searchable, owned by nobody.

Delegated mailboxes. Shared and delegated mailboxes that a surprising number of people can open, and that an assistant can now search on their behalf.

Temporary copies. A payroll export saved into a team folder “just for a minute”, a contract draft attached to a chat channel, a scan of an identity document left in a downloads folder that syncs.

Stale versions. Not a confidentiality problem but an accuracy one. The assistant quotes the old price list with complete confidence, because that is the version it found first.

What to do before switching it on, or right after

Find the broad shares first. List everything shared with the whole organisation, with large all-staff groups, or through anonymous links. In most companies this is a short list of very large folders, which makes it a tractable problem rather than an endless one.

Protect the few things that matter. HR, payroll, contracts, board material, customer personal data. Move them to places with small, explicit permission lists and a named owner, rather than trying to classify every document in the company.

Give every shared space an owner. Somebody who reviews its membership twice a year. Spaces nobody will own get archived out of the searchable set.

Start the assistant narrow. Point it at curated sources first — policies, product documentation, the current price list, the procedures people ask about every week — and widen its reach as the permissions are cleaned up. Being able to choose that scope, and where the assistant runs, is the point of an AI-native workplace you control rather than a feature switched on for everyone at once.

Retire the old versions. Archive superseded documents so the assistant answers from the current ones. This is the unglamorous half of making an assistant useful: it can only be as good as the material it reads.

Keep a log on the approved route. What was asked, which sources were used to answer, and by whom. It is the same principle as in your staff already use AI: the first serious question from a customer or an auditor will require reconstructing what happened, and that is impossible without a record.

Why this is an ownership question

The permission mess is not the assistant’s fault and it is not new. It is what happens when a file store grows for years without anybody responsible for its shape. An assistant just turns a latent problem into an immediate one.

Companies that know where their sensitive material lives, who owns each shared space and which version of a document is current get a useful assistant almost for free. Companies that do not will find out, one surprising answer at a time.

The test

Log in as an ordinary employee, not an administrator. Use the normal search box in your document store and mail, and search for a few words: salary, payroll, contract, password, and the name of your national identity number. Look at what comes back.

Whatever an ordinary account can find with the search box today is what an assistant will surface tomorrow, faster and with a summary. Then ask whoever administers the store for one list: every item shared with the whole organisation or through an anonymous link. Those two results are your clean-up plan, and you can have both before lunch.