Enterprise AI assistants, such as the copilots built into productivity suites, CRM, IT service management and developer platforms, work with the same permissions as the person using them. That sounds safe, and in principle it is. In practice, most organisations have years of over-shared files, broad group memberships and forgotten permissions. An assistant that can instantly search everything a user can technically reach turns those hidden mistakes into easily discovered data. Copilots are also gaining the ability to act: sending messages, updating records and triggering workflows. This guide explains the identity and data risks of enterprise copilots and how to prepare, deploy and monitor them safely.
Key takeaways
- Copilots usually respect existing permissions, so their biggest risk is existing over-sharing. Fix permissions before broad rollout.
- Use sensitivity labels, restricted search scopes and data loss prevention to keep the most sensitive content out of AI answers.
- As copilots gain actions and agents, treat them as NHIs: scope their connectors, require approval for high-impact actions and monitor use.
- Prompt injection through emails, documents and web content applies to copilots too.
How enterprise copilots access data
- The copilot runs in the user's context and queries data the user can access, often through an index or graph of the organisation's content.
- Connectors and plugins extend reach into other systems, sometimes using the user's delegated token, sometimes a shared integration identity.
- Agent-building features let users and makers create custom agents with their own connectors and actions. See the Low-Code Agent Platforms Guide.
The risks
- Over-shared content surfaced: files shared with "everyone", broad sites and old project spaces become answers to simple questions.
- Stale access: movers who kept access to old departments can now search that content effortlessly. See the Joiner-Mover-Leaver Guide.
- Connector over-reach: plugins or connectors with broad integration permissions expose data beyond the user's normal access.
- Prompt injection: malicious content in email or documents manipulates the assistant, as in the Gemini calendar prompt injection.
- Agent token abuse: the CoPhish campaign abused Copilot Studio agents to steal OAuth tokens.
- Data in prompts and outputs: sensitive content copied into prompts, or AI outputs stored where they should not be.
Before rollout: prepare permissions
- Find over-sharing: content shared with everyone or large groups, anonymous links and inactive sites with broad access.
- Prioritise sensitive locations: HR, legal, finance, M&A, executive and customer data.
- Clean up: remove broad sharing, archive inactive sites, fix group membership.
- Label: apply sensitivity labels and use them to restrict AI processing where needed.
- Restrict scope temporarily: exclude sensitive sites from AI search while clean-up continues.
This is essentially access governance applied urgently. See the Access Reviews Guide.
During rollout
- Pilot with groups whose access is well understood; expand in waves.
- Approve connectors and plugins centrally; check whether they use delegated or shared identities and what they can reach.
- Restrict who can build and share custom agents; require owners and review. See the Agentic AI Identity Guide.
- Enable data loss prevention policies for AI interactions where supported.
- Train users on appropriate use and on recognising manipulated outputs.
When copilots act
- Require confirmation for actions such as sending external email, changing records, sharing files or approving workflows.
- Limit actions for users handling sensitive processes.
- Treat custom agents with actions as NHIs with owners, scoped connectors and monitoring. See the AI Agent Authorisation Guide.
Monitoring
- Use audit logs of AI interactions: who asked what, which content was referenced, which actions were taken.
- Alert on sensitive content referenced by unexpected users, unusual query volumes and agent actions outside normal patterns.
- Review and remove unused agents and connectors.
Practitioner checklist
- Run an over-sharing assessment and clean up sensitive locations before broad rollout.
- Apply sensitivity labels and restrict AI processing of the most sensitive content.
- Roll out in waves; approve connectors and control agent creation.
- Require confirmation for high-impact actions.
- Enable AI interaction logging and DLP; monitor usage.
- Treat custom agents as governed NHIs.
Standards and references
- OWASP Top 10 for LLM Applications (2025): LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM06 Excessive Agency
- OWASP Top 10 for Agentic Applications for 2026
- NIST AI Risk Management Framework
Related NHI Mgmt Group resources: Permission-Aware RAG Guide · Low-Code Agent Platforms Guide · Shadow AI Discovery Guide · Who Governs AI?
