TL;DR: Glean combines LLMs, semantic search, and permission-aware retrieval to reduce enterprise search friction, but Knostic argues that oversharing persists because static access models cannot reliably enforce need-to-know boundaries when AI synthesises context from multiple systems. The real governance problem is not search accuracy, but whether AI can expose permissible yet operationally inappropriate information.
At a glance
What this is: This is an analysis of Glean AI search security that finds oversharing persists when LLMs synthesize permissible content into answers that exceed need-to-know boundaries.
Why it matters: IAM and security teams need to see that static permissions, RBAC inheritance, and tenant isolation do not fully solve AI-driven exposure when retrieval and generation happen at query time.
Context
Enterprise AI search changes the control problem from finding documents to governing what an answer is allowed to reveal. When an LLM can combine context from multiple systems, a user may remain within their static permissions while still receiving information they were never meant to see.
This article focuses on the gap between can-access and need-to-know. That gap is most visible in AI search, where zero-copy indexing, ACL inheritance, and tenant isolation reduce duplication risk but do not fully prevent oversharing at response time.
Key questions
Q: What fails when AI search uses static permissions alone?
A: Static permissions control access to source objects, but they do not fully control how an AI system recombines approved fragments into a new answer. That is why a user can remain within entitlement while still seeing contextually inappropriate information. The failure is at response time, where disclosure intent matters as much as document access.
Q: Why can enterprise AI search overshare even when ACLs are in place?
A: ACLs can block direct access to specific source content, but they do not always govern synthesis across multiple permitted sources. When the model joins fragments from docs, chats, and tickets, it can reveal strategy or operational detail that no single object exposed alone. The risk is aggregate disclosure, not just broken permission checks.
Q: What do security teams get wrong about AI search oversharing?
A: They often assume encryption, tenant isolation, and source permissions solve the disclosure problem. Those controls protect storage and access, but oversharing happens at the response layer when an AI model fuses fragments from different systems. The real failure is treating answer generation like ordinary search.
Q: What should organisations govern when AI search sits on top of enterprise data?
A: They should govern the disclosure rules for generated answers, not only the entitlements on the underlying repositories. That means deciding which roles may receive synthesised context, which source combinations are allowed, and which topics require review before the AI response is shown.
Technical breakdown
Why static permissions do not fully govern AI answers
Static permissions control whether a user can reach a source object, but they do not fully control how an LLM recombines multiple allowed fragments into a new answer. In enterprise search, retrieval happens across vector indexes, metadata, and connected systems, then the model synthesises a response that can reveal context no single source exposed on its own. That is why ACL enforcement at ingestion is necessary but incomplete. The real exposure point is the generated answer, where the model can preserve permission compliance while still violating role intent.
Practical implication: treat answer-generation policy as a separate control plane from source-system permissions.
How zero-copy indexing changes the threat model
Zero-copy indexing keeps documents in their source systems and reduces duplication risk, but it does not remove the risk of access sprawl. The security benefit is narrower attack surface and less replicated sensitive data. The residual risk is that broad entitlements still allow an AI layer to infer and present material a user did not directly open. In other words, the storage model is safer than copying content into a new repository, yet governance still fails if query-time reasoning is not constrained by usage context.
Practical implication: pair zero-copy architecture with query-time oversight rather than assuming storage locality solves oversharing.
Why oversharing is a need-to-know problem, not just a search problem
Oversharing emerges when the system returns truthful but operationally inappropriate information. That distinction matters because traditional IAM answers who may access an object, while AI search must also answer whether the user should be shown the synthesis. Knostic frames this as a mismatch between can-access and need-to-know, and that is the right lens for enterprise AI governance. Once an LLM blends sources such as docs, chats, and tickets, the security question becomes contextual disclosure, not only document access.
Practical implication: define acceptable disclosure rules for AI responses, not just access rights for underlying data.
Threat narrative
Attacker objective: The objective is to extract contextually sensitive information without crossing a hard permission boundary, using the AI layer to assemble what static controls permit separately.
- Entry occurs when a user submits a natural-language query that is valid under normal access rules but broad enough to pull context from multiple connected systems.
- Credential or permission abuse is not required because the AI can legally retrieve permissible fragments from disparate sources and combine them into a richer answer.
- Impact occurs when the generated response surfaces sensitive strategy, timelines, or operational detail that no single document exposed in isolation.
Breaches seen in the wild
- McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Need-to-know is the broken assumption: Static permissions were designed for object access, not for AI synthesis across multiple permissible sources. That assumption fails when the actor is a language model that can assemble contextually inappropriate answers from fragments the user was never meant to see together. The implication is that enterprise search governance has to measure disclosure risk at response time, not only entitlement status at source.
Zero-copy reduces duplication, not disclosure risk: Keeping documents in place is a sound data-sprawl control, but it does not eliminate the governance problem created by retrieval across connected systems. The real exposure happens when the AI layer is allowed to infer meaning from distributed context and present it as a single answer. Practitioners should treat the answer as the governed object.
Need-to-know must become a runtime policy: In AI search, the policy question is no longer whether a user can reach a file, but whether the system should surface a synthesis built from multiple sources. That is a qualitatively different governance problem from file permissioning, and static labels cannot resolve it on their own. Organisations need controls that understand disclosure intent, not just storage entitlement.
Auditability shifts from document access to answer lineage: Traditional logs prove that a user opened a resource, but they do not always prove why the AI produced a specific synthesis. That makes prompt, retrieval, and response lineage the critical audit artefacts for enterprise AI search. Security teams should assume the important control evidence sits in the generated answer path, not the source repository.
Contextual oversharing is an identity problem as much as a data problem: The user’s authenticated identity may be correct while the disclosed context is still wrong for their role. This widens the IAM conversation beyond login assurance into disclosure governance across human, NHI, and AI-mediated workflows. Practitioners should align permissions, context, and business role before AI response generation.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Authorisation Guide
What this signals
Contextual oversharing: enterprise AI search creates a new governance layer where disclosure happens at response time, not at document access time. That means the security question moves from who can open a file to who should receive a synthesis built from several permitted sources.
Static labels are too coarse for AI search because they describe the source, not the answer. If a role can legitimately retrieve fragments from multiple systems, the control gap appears when those fragments are combined into a sensitive narrative that the user was never meant to see.
For practitioners
- Define response-time disclosure policy Set explicit rules for which combinations of source documents, chats, tickets, and metadata may be synthesised into one answer for each role.
- Instrument prompt and response logging Capture the user prompt, retrieval path, cited sources, and final answer so security teams can review why a given synthesis was produced.
- Test for contextual oversharing Run red-team queries that combine individually permitted fragments from multiple systems to see whether the model reveals strategy, timelines, or sensitive operational context.
- Reclassify high-risk answer patterns Identify topics where benign-looking source data becomes sensitive when aggregated, then mark those answer patterns for tighter review and approval.
- Review source-system entitlements Check whether broad inherited permissions allow AI search to expose more context than each role actually needs to know in practice.
Key takeaways
- AI search changes the access-control problem from retrieving documents to governing what the generated answer is allowed to disclose.
- Zero-copy architecture and permission inheritance reduce duplication risk, but they do not eliminate oversharing when the model synthesises context across systems.
- The control point that matters most is response-time disclosure policy, backed by prompt, retrieval, and answer lineage logging.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AI search depends on correct identity and access validation before retrieval and synthesis. |
| NHI-05 — Overprivileged NHI | Broad entitlements let AI search expose more context than a role needs to know. | |
| NHI-10 — Human Use of NHI | Human users interact with an AI-mediated identity layer that can over-disclose information. | |
| Recommendation — Validate that AI search inherits and enforces identity checks before any retrieval or answer generation. Reduce broad inherited access so AI search cannot synthesise overly exposed context from permissible sources. Govern human interaction with AI search so disclosure rules apply to the generated answer, not just the source data. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on entitlement enforcement versus AI-generated disclosure. |
| PR.DS-01 — Data-at-rest is protected | The article discusses encrypted, isolated data handling as part of the control stack. | |
| Recommendation — Review permissions and entitlements with disclosure context in mind, not only source access. Protect stored AI search data while still addressing query-time oversharing controls. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Connectors use service accounts and secure OAuth flows to access source systems. |
| Recommendation — Manage authenticators and service credentials that feed enterprise AI search connectors. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The article references AI security leak paths that can expose API keys and secrets in connected systems. |
| Recommendation — Map exposed API keys and secrets to credential-access techniques and monitor connected sources for leakage. | ||
Key terms
- Oversharing: Oversharing is the unintended disclosure of sensitive or restricted information by an AI system. It can happen through prompts, retrieval, output generation, or connector scope, and it becomes a governance issue when access controls do not match the sensitivity of the underlying data.
- Need-to-know: Need-to-know is an access principle that limits data exposure to the minimum required for a task. In AI systems, it applies not only to the human user but also to connectors, service identities, and retrieval workflows. It is one of the clearest ways to reduce overexposure in copilots and search tools.
- Zero-copy indexing: Zero-copy indexing keeps source content in place and stores only what is needed to retrieve it, usually vectors and metadata. It reduces duplication and sprawl, but it does not remove disclosure risk, because the AI can still synthesise sensitive output from permitted fragments at query time.
- Permission Inheritance: The practice of allowing access on one object to flow into related objects through defined traversal rules. It reduces duplicate configuration, but it also creates hidden privilege paths that must be understood and reviewed. In complex systems, inheritance is often the real source of effective access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org