Who sees what? Permissions for AI that searches documents
An AI that searches documents must never show anyone more than that person may see in the document system. The safest way is for the AI to read with the person's own access in the source system instead of copying all documents into a shared search index. Where documents do sit in the AI, for example in an app, they belong in separate collections with their own sharing. Before you start, check for folders that are shared too widely.
Why do permissions matter more with AI?
Until now, effort was often the protection: if you did not know a document existed, you did not find it. An AI searches every repository it can reach in seconds and summarises what it finds. That makes every share that is too wide visible. A salary folder that was accidentally shared with everyone suddenly turns up in the answer to a question about “salaries in the department”.
Microsoft has published a separate guide on oversharing in SharePoint for its own AI assistant. But the problem affects every AI that searches documents. OWASP lists inadequate access controls in the search stores of AI applications among the ten most important risks.
Copy in a search index or access in the source system?
There are two basic patterns for how an AI gets to documents:
| Copy into a search index of the AI | Access in the source system | |
|---|---|---|
| How it works | Documents are read in advance and stored in the AI. | The AI queries the document system when someone asks. |
| Who checks permissions | the AI, based on permission information carried over | the document system itself |
| Risk | Permissions become outdated or are carried over incorrectly; the index becomes a second data store | Oversharing in the document system still has an effect |
| Good for | fixed collections, such as guidelines or handbooks | repositories with many, changing permissions |
For repositories with fine-grained permissions, such as personnel, patient or case-file folders, access in the source system with the person’s own access is the safer route. For collections that a whole group may read, a copy in the AI is practical.
What applies to documents stored in the AI itself?
Here, sharing within the AI decides. A proven approach is to organise documents into collections with a clear circle of readers: guidelines for the whole organisation, HR templates only for HR. Check with the vendor whether permissions apply at the level of the collection or of the individual document. With collections, whoever may use the collection reaches everything in it. Confidential material then belongs in a separate collection.
What should you check before you start?
- Find oversharing: Which folders and pages are shared with “everyone”? Many document systems have reports for this.
- Define particularly sensitive areas: HR, health, case files, contracts. Check these first or leave them unconnected at the start.
- Clarify the access route: Does the AI read with the person’s account or with a shared account? A shared account that sees everything overrides the permissions of the document system.
- Divide collections in the AI: Which documents go into which collection, for which group?
- Logs: Does the audit log record who queried which repository via the AI?
How groups and roles from your user directory reach the AI is described in Roles and permissions from the user directory.
How does this work with basebox?
The AI may never do more than the person using it. Via connectors, for example to SharePoint, Nextcloud or Confluence, each person signs in with their own access; a shared service account only if you want one, and the target system enforces its permissions. The person sees only what they may see there anyway. By default basebox only reads, and every call to a connector is recorded in the audit log. Network drives are different: with the server, we connect them during setup with one access for the whole organisation, read-only. Their files are used in an app, and who sees them is decided by the app’s sharing, not by the permissions on the drive.
Documents stored in an app or knowledge base are shared by the author with groups or individual people, to use or to edit. Whoever may use an app reaches all documents stored in it; there are no permissions for individual documents there. Confidential material therefore belongs in a separate app for the right circle of people. Sharing an app shares its documents, never your own access: whoever uses a shared app still sees only their own data via connectors. When a document is deleted, basebox removes the original, the extracted text and the search index.
Frequently asked questions
What is oversharing?
A folder or page is shared with more people than necessary, for example with "all staff". Without AI this rarely shows, because nobody goes looking. An AI finds such documents as soon as someone asks a matching question.
Is it enough to block confidential documents in the AI?
It is better to fix the cause: correct the permissions in the document system. A block only in the AI leaves the oversharing in the document system in place, and any other search still finds the documents.
Do permissions still apply when the AI summarises an answer?
A summary is only as confidential as what the AI was allowed to read for it. If it reads only what the person may see, the summary contains nothing else either. Whoever passes an answer on, however, decides for themselves who sees it.
Sources
This article was created with the help of AI, based on the sources listed. Responsible for the content: basebox GmbH. Not legal advice, no liability. Research as of 11 October 2026.