Connecting an AI assistant to company documents safely means preserving each person's existing access rights throughout search and answer generation. A connector's permission is not proof that every indexed folder is suitable for every user. Identity, file scope, indexing, retention, logs and revocation all need a defined owner.
Map the document journey
A document assistant may include a connector, text extraction, a search or vector index, retrieval logic and a language model. In retrieval-augmented generation (RAG), relevant passages are fetched when a question is asked; they are not necessarily part of the model's trained knowledge. Each step creates its own access and retention boundary.
- Identity: verify the person, service and organisation making the request.
- Source: define allowed repositories, folders and file classifications.
- Index: retain document identity, version, applicable access rules and last sync time.
- Retrieval: filter by the requester's permissions before ranking and sending excerpts to the model.
- Output: show sources and require review before a consequential change or share.
Enforce permissions before retrieval
Checking access only after the model has received a passage is too late: the information has already entered its context. Associate each indexed segment with its source and access metadata, and filter results on the server before constructing the prompt. If permissions cannot be synchronised reliably, use a separate collection whose access has already been reviewed.
Separate identity, read and write access
Authentication answers who is asking; authorisation determines which documents they may read. Derive identity from a verified session or token, not a browser-supplied email or role. Give integrations dedicated identities and minimum scopes. Reading documents should not silently grant permission to edit, delete or share them.
Treat indexes, logs and copies as business data
Before connecting files, check whether the provider retains prompts, answers, attachments, excerpts and indexes, for how long, in which region and with which administrative access. A no-training commitment does not by itself mean that prompts or logs are not retained. Keep diagnostic logs useful but avoid copying full document text without a need.
Test revocation and hostile document content
When access changes or a file is deleted, check that the index and caches stop returning it within an agreed interval. Retrieved text is untrusted input: a document can contain prompt-injection instructions. It must not expand its own permissions or authorise an external action. Test with accounts that have different roles and include a deliberately unauthorised document.
A short readiness checklist
- Define allowed folders and excluded sensitive categories.
- Test retrieval with one authorised and one unauthorised user.
- Check retention, data use, administrators, subprocessors, export and deletion for the actual plan.
- Keep read, edit and send permissions separate; require review where appropriate.
- Test file removal, permission changes, token revocation and a manual fallback.
OWASP's LLM guidance and the NIST AI Risk Management Framework provide useful ways to structure security and lifecycle checks. They are references for assessment, not automatic certifications or substitutes for legal and contractual review.