The pilot ran for three days before someone asked a question the organization wasn’t ready to answer. A manager asked the internal assistant about the assumptions behind next year’s staffing plan. The assistant generated a precise summary and cited its source: a salary workbook sitting in a SharePoint folder whose permissions were inherited from a broad, legacy planning site. Nobody intended that workbook to become the definitive answer to a general staffing question. But the assistant respected the permissions. It found the file. It answered the prompt.
For two decades, enterprise search was so poor that organizations relied on it as an implicit security boundary. If a sensitive spreadsheet was buried twelve folders deep on a legacy mapped drive, users only found it if they already knew the exact path. Security by obscurity relies on a user giving up after page two of the search results. A retrieval-augmented generation system never gives up. Vector embeddings map conceptual relationships. A file containing columns for “target incentive” and “multiplier” gets mapped to the same semantic neighborhood as “bonus,” surfacing documents that a traditional keyword search would miss.
Vendors sell enterprise AI on the premise that the assistant strictly respects existing permissions. That is the problem. Your existing permissions are a fifteen-year accumulation of nested Active Directory groups, broken inheritance, and temporary access grants that became permanent. During the migration from on-premises file shares to SharePoint, NTFS access control lists were mapped one-to-one. “Domain Users” and “Authenticated Users” came along for the ride. The retrieval engine queries the index using the user’s Entra ID token. The system operates exactly as designed. The failure occurs because the underlying access token carries legacy group memberships the user no longer needs. The assistant is the first user who reads everything.
The security team eventually runs a single query against the pilot environment to find documents containing the word “confidential” that are accessible to all employees. The list returns four thousand entries. The permissions cleanup project gets funded the next morning. Before the assistant, those four thousand documents were safe because nobody knew where to look. Now, every broken access control list is a chat prompt away from a company-wide email.
Access controls answer who may see a result. They do not answer whether the file was shared appropriately, or whether it is still true. The stale document problem is harder than the permissions problem. Permissions can be fixed with tooling. Currency requires human judgment, and most organizations lack the metadata to scale that judgment.
An employee asks the assistant about the remote work hardware stipend. The assistant summarizes a generous, short-lived policy from April 2020. A dozen expense reports are submitted and subsequently denied by Finance. The assistant doesn’t know the policy was superseded. It only knows what is in the index.
“Final” is a filename convention, not a records status. A folder named “Final” might contain twenty-three different documents, all marked “Final,” all representing different points in a negotiation. The assistant treats them with equal authority.
To fit documents into context windows, retrieval systems slice large files into smaller chunks. A disclaimer on page one stating “This policy is deprecated” is separated from the policy details on page four. If a user’s query semantically matches the details on page four, the system retrieves that chunk without the disclaimer. The context window flattens the retrieved text. The model cannot inherently weigh the authority of a finalized PDF against a scratchpad text file if both are retrieved. It synthesizes them into a single, confident paragraph.
The instinct is to restrict the crawl to approved, curated content. You can do this. Then you find out how little approved content exists, and how much of the daily work depends on the unapproved stuff. Within two weeks, users complain the assistant is useless because it doesn’t know anything about their specific department’s operations. You cannot bolt a modern retrieval engine onto a fifteen-year-old permissions structure and expect anything other than a data leak, but restricting the index to a pristine subset just breaks the tool’s utility.
Deploying an internal assistant is a forced forensic audit of unstructured data. Records management and retrieval are the same problem viewed from different ends. One is compliance-driven, the other is query-driven. The corpus is the same.
The model is a commodity. You can swap the underlying large language model in a week. The corpus took a decade to accumulate, and nobody has cleaned it. The corpus is the product.
The permissions review is not a gate you pass before turning the system on. It is part of the implementation. You will not finish it before you start. The query log from the pilot is the most honest permissions audit you will ever run. It shows what people actually asked for, and what the assistant actually returned. Read it.
Put records owners and access owners in the pilot alongside the engineering team. Before widening the connector, give them a way to identify authoritative copies, retire superseded ones, and correct inherited access. When the assistant inevitably cites a document that should have been deleted in 2019, you need a documented, tested procedure for flushing specific files from the retrieval index within minutes of discovery. Relying on the vendor to rebuild the entire tenant index because of one bad document is not an operational strategy.
The retrieval engine will surface every document your permissions allow it to find. Deciding what it should find is the rest of the project.