What is access control in AI?
Access control decides who may see which information, and in an AI system it decides which documents an answer may build on.
In most organisations documents are already divided up. HR has its folders and management has its own. An AI assistant needs to follow the same division.
If it does not, a question about salaries can return an answer from a document the person asking would never have been allowed to open. It is one of the most common problems when AI is connected to internal documents.
With the right controls, the same question gives different answers depending on who asks. An employee is told the information is not available, while HR gets the answer with its source.
How it works
Each user signs in with their organisation account. The system knows which groups they belong to and which documents those groups may read. When a question is asked, the AI only searches among those documents. Anything the user has no access to never reaches the model, so it cannot shape the answer.
Why it matters
An AI assistant makes information much easier to find. That is the benefit, and it is also the risk. Without access control, a simple question can surface answers that used to require knowing where a document was and having the right to open it. Access control is therefore a precondition for connecting AI to sensitive material.
What to keep in mind
AI often exposes weaknesses that were already there. Folders left open to everyone by mistake suddenly become easy to find. Review permissions for the material you plan to connect.
Follow the principle of least privilege. It applies to staff and to AI agents that act in other systems.
What it means for you
Check that the AI tool follows your existing permissions and does not create its own shortcut around them.
Common questions
Can AI read documents a user is not allowed to see?
It should not be able to. An AI assistant needs to follow the same permissions as your other systems, so answers only draw on what the user is allowed to read.
How is AI connected to our existing permissions?
Usually through sign-in with the organisation's existing accounts and groups. Permissions then follow when someone changes role or leaves.
How can we see who asked what?
With an audit log that shows who asked which question and which documents the answer drew on.
Related terms
Read more
All terms Updated