Topic starter
14/07/2026 6:04 pm
TL;DR: Microsoft 365 Copilot was found accessing confidential emails in Outlook Sent and Draft folders that users had marked restricted, with the issue patched on February 20 after appearing in late 2025, according to Swarmnetics. The problem is not just a product bug but a governance failure: once an AI system can see sensitive content, access scope, metadata handling, and retention assumptions all need explicit control.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: ““Agentic” AI Tools Continue to Struggle as Copilot Helps Itself to Confidential Emails”.
Key questions
Q: What breaks when agentic AI tools can read confidential content outside their intended scope?
A: The failure is usually not that the model becomes inaccurate, but that delegated access is broader than the governance boundary.
Q: Why do AI tools create governance risk even when humans stay in charge?
A: AI tools create risk when they reshape the real decision path without changing formal ownership.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Map every AI mailbox permission path Document which folders, message states, and label combinations an agentic tool can read, summarise, or retain, then test the actual enforcement across each path.
- Treat AI tools as governed non-human identities Assign ownership, scope, review cadence, and revocation triggers to each AI system that can access confidential business data, the same way you would for a service account.
- Validate label enforcement at object level Check whether classification labels survive across inbox, Sent, Draft, shared mailbox, and reference collection workflows instead of assuming one rule covers all locations.
Bottom line: Agentic AI tools can break governance even when they do not visibly expose the data they process, because access scope and retention still matter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:09 pm
Agentic AI governance fails first at the boundary, not the model. This case is not primarily about whether the AI summary was accurate. It is about whether the tool could reach content that policy said should be out of scope, which is an access-governance failure. For identity teams, that means the control question moves from output review to permission scoping and data-class boundary enforcement.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: How should organisations govern confidential data when AI assistants are given mailbox access?
A: They should treat the assistant as a non-human identity with explicit scope, ownership, and revocation rules. That means defining which data classes it may read, what it may retain, and when access must be withdrawn. If those decisions are not recorded and reviewed, the organisation is relying on informal trust instead of controlled delegation.
👉 Read our full editorial: Copilot email access shows the AI governance gap in agentic tools