A lot of $10M to $30M companies are turning on Microsoft Copilot and similar AI assistants this quarter. The rollout usually looks simple. Buy licenses, assign them to a pilot group, run a training session.
The part that gets skipped is file permissions. These tools search the files each user can already open. If your SharePoint and Teams permissions are broad, the assistant will surface material that most people never went looking for before, and it will do it in seconds.
How the search actually works
Copilot and tools like it build answers from documents, emails, chats, and meeting files tied to the signed-in user. The tool respects the permissions on each file. A user cannot pull a document they have no access to through the assistant.
That control helps, but it depends on permissions being accurate. In most mid-market environments, permissions grew over years without a cleanup. A folder shared with the whole company for one project in 2022 stays shared. A Teams site created for a pricing review still includes people who changed roles. Links set to anyone in the organization stay active because nobody owns the follow-up.
AI search changes the exposure. A plain question can return a salary summary, a customer contract, or a draft acquisition note if the user has access to the source file.
Three places oversharing usually hides
Start with SharePoint sites that hold finance and HR material. Check who can open payroll files, compensation spreadsheets, performance reviews, and benefits documents. Look at group membership, not just the site name. A site labeled Finance may include a broad operations group that was added for one report.
Next, check sharing links. Search for links shared with everyone in the company and links shared with specific people who have left or moved teams. Old proposal folders and vendor contracts are common finds here.
Then check executive and legal material. Board packets, lender documents, customer agreements with pricing, and personnel investigations need narrow access by default. If that material sits in a general document library, the assistant can quote it to anyone with library access who asks the right question.
Run a test before the wide rollout
Pick two or three standard user accounts from different departments. Sign in as those users, or work with the account owners in the room, and ask the assistant direct questions.
Ask for executive compensation details. Ask for the margin on your largest customer. Ask for HR notes on a recent termination. Ask for passwords, banking details, and contract terms.
Write down what comes back, including the source file for each answer. Each unexpected result points to a specific permission to fix. This test takes about an hour and gives you a concrete list with file names and owners.
Repeat the test after you fix the first batch.
Fix permissions in a workable order
Fix the highest-risk folders first: payroll, HR investigations, banking, legal holds, and executive compensation. Remove broad groups, add named groups with a clear owner, and set a review date.
Give each sensitive site an owner who approves new members. Access requests should go to that owner, with a reason and an end date for temporary access.
Turn on sensitivity labels where your license includes them for files that should stay inside a small group. Labels travel with the file when it gets copied or emailed.
Keep the pilot group small until the test results are clean. A pilot of 10 to 15 people from mixed departments gives you useful feedback and limits exposure while you clean up. Expand by department after each department passes the same search test.
Add this to your regular governance
Add a quarterly permission review to the calendar. Pull a report of sites with broad access, review sharing links older than 90 days, and confirm owners for every sensitive library.
Track the work in a short log: date, tester, questions asked, files found, permission changed. That log shows your insurer, your auditor, and your leadership team that AI use at the company runs under a defined control.
AI assistants save time on search and drafting. That value holds up when the underlying permissions are accurate. Clean permissions first, then expand the rollout with evidence that sensitive material stays with the people who need it.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.