Separate public and internal use
A website visitor should not share the same access as a company director. Define separate knowledge and journeys even when the interface looks similar. Approve public material for that audience. Do not use private documents as demonstration content without reviewing permissions and purpose.
Respect the user’s access
Specify roles and check permissions before retrieving information. An assistant should not expand someone’s access merely because it knows an answer. Test role changes, sign-out and restricted document links. Enforcement belongs in the server and sources, not just in hidden interface buttons.
Limit tools and secrets
Grant only operations needed for the scenario. Keep credentials out of the browser and responses. Review data sent to external providers and who may change configuration. Instructions found inside a document are document content, not authorisation for the assistant to take action.
Record and review boundaries
Design useful records of questions, sources and actions with agreed retention and access limits. Explicitly test attempts to obtain another role’s information. Define access revocation and investigation of inappropriate answers. A “secure AI” label is not a substitute for these concrete checks.
Key takeaways
- Answers must respect the same boundaries as source data.