AIArtificial intelligence

Connecting an AI assistant to company systems: permissions, logs and data without security gaps

Once connected to email, archives and the ERP, an AI assistant finds everything that the permissions leave open. These are the rules on access, logs and data routes to settle before it goes live.

Strategic editorial team 16 September 2026 9 min read

Cover: “An AI assistant in your systems, without gaps”, Artificial intelligence

An artificial intelligence assistant can be connected to company systems without opening security gaps if three things are decided before it goes live: which permissions it uses to read data, what is recorded of every question and every action, and which routes the information travels along. The model chosen matters less than people think. In most cases the problems come from the connections. Think of a delegation on a shared mailbox that was never revoked, a service account with too many privileges, or a log that nobody has decided who may read.

Why does connecting an assistant to company systems change the risk?

As long as an AI assistant works on its own, it receives only what the person pastes into it. Once it is connected to email, document archives, the CRM or the ERP, it goes looking by itself. That is precisely where its value lies, and it is also why any disorder in permissions becomes visible.

Microsoft’s documentation for its office assistant says so clearly. The system shows each user only the company data they have at least permission to view, so it is important to make good use of the permission models already in place. Put simply, the assistant inherits exactly the permissions that exist, wrong ones included.

A typical scenario. After a merger between two group companies, the users of the absorbed company were added en masse to an “Everyone” group, which had access to the purchasing department’s shared mailbox. Nobody reviewed the delegations. Two former managers who have since moved to other roles have kept access to that mailbox for three years. On the day the assistant is connected to email with each user’s permissions, a general question about a supplier’s terms returns extracts from confidential offers to people who should not see them. The system respected the permissions to the letter. It was the permissions that were wrong.

Which permissions should the assistant work with?

The rule is least privilege. Each component receives only the access it needs for its task, and nothing more. In practice there are two possible architectures.

The assistant acts with the identity of the person asking. Every search goes through the source system’s own checks. If the person cannot open a document, the assistant does not read it.
The assistant uses a single service account and does its own filtering. It sees everything and decides what to show. It is simpler to build, but protection depends on a single software filter.

The first route is the one recommended by OWASP, the international community that publishes application security guidelines. In its 2025 ranking of the risks of applications built on language models, it recommends running extensions in the user’s context and leaving authorisation checks to downstream systems, rather than relying on the model’s judgement. The Model Context Protocol (MCP), the increasingly common standard for connecting assistants to business tools, also forbids servers from accepting credentials that were not issued specifically for them.

To get started, this table helps set the access levels.

System	Recommended initial access	To decide before go-live
Archives and shared folders	Read-only, with the permissions of the person asking	Cleaning up shares open to everyone
Email	Only the mailbox of the person asking	Shared mailboxes and delegations
CRM	Read access to contact records and activities	Confidential notes and deals in progress
ERP and other business software	Read-only views prepared by IT	Whether, and where, to allow writing
Database	An account that can only read defined views	No administrative account, under any circumstances

Before go-live it is also worth carrying out a review. Look at delegations on shared mailboxes, groups inherited from mergers and reorganisations, links open to “anyone with the link”, and the accounts of people who have left the company or changed role. Fixing permissions at source also protects every other tool that relies on them, whereas a filter added to the assistant protects only the assistant.

What needs to be logged?

The log lets you answer some very concrete questions weeks later: who asked what, which documents were consulted, what answer was given, which actions were taken and under which identity. Without that trail you cannot reconstruct an incident, just as with the log files of traditional systems, and you cannot understand why an answer was wrong.

For some systems the log is an obligation. The AI Act, the EU regulation on artificial intelligence, requires deployers of systems classified as high-risk to keep the logs those systems generate automatically for at least six months, unless other rules provide otherwise. Following the amendments introduced by Regulation (EU) 2026/1744, the obligations for the high-risk systems listed in Annex III apply from 2 December 2027. For other assistants there is no specific obligation, but all the practical reasons still stand.

There is, however, a limit to respect. A log of questions contains personal data and says a great deal about the work of whoever asks them. The Italian Data Protection Authority (Garante), dealing with the metadata of employees’ email, indicated that retention should normally be limited to a few days and, as a guideline, should not exceed 21. Generalised collection over a longer period can amount to remote monitoring of employees’ activity. It then requires the safeguards of Article 4 of Italy’s Workers’ Statute (Statuto dei lavoratori), which means either an agreement with the trade unions or authorisation from the National Labour Inspectorate (Ispettorato del lavoro). The case is different, but the criterion is useful for AI assistants too. For companies based in San Marino the framework is different and must be assessed case by case.

That is why the log is designed together with the data protection officer (DPO) and legal counsel:

Written purposes, such as security, answer quality and audits, and never the assessment of individuals.
Access restricted to a few roles, which are themselves logged.
Defined and justified retention periods.
Content limited to what is necessary, for example references to the documents consulted rather than their full text.

Which routes does the data travel?

Every question travels. It goes from the user to the service, from the service to the model, and sometimes on to other sub-processors. Before go-live, four things must be put in writing: where processing takes place, the list of sub-processors, how long questions and answers are kept, and whether the content is used to train models.

One example shows why the details matter. Microsoft states that the questions, answers and data read by its assistant are not used to train its foundation models, and that traffic from EU users stays within its EU Data Boundary. The same page, updated in August 2026, also states that models supplied by Anthropic as a sub-processor are currently excluded from that boundary. Within the same product, then, a configuration choice changes the route the data takes. That choice must be made knowingly and written down.

On the regulatory side, a supplier that processes personal data on the company’s behalf must be appointed as a processor, under a contract that meets Article 28 of the GDPR. Security measures are assessed under Article 32. If the processing is likely to result in a high risk, a data protection impact assessment is required (Article 35).

What should you test before go-live?

Acceptance testing of an assistant connected to company systems is not just about checking that the answers are good. It takes targeted tests.

Role-based tests. Using test accounts from different departments, you ask questions that should get no answer. The warehouse asks about salaries, and a salesperson asks for the contracts of another area. The correct answer is that the information is not available.
Hidden instructions. You insert sentences addressed to the assistant into an email or a document, to check that it does not carry them out. This is not a theoretical risk. In June 2025 Microsoft fixed a vulnerability in its assistant (CVE-2025-32711, rated 9.3 out of 10 by Microsoft itself) that made it possible to steal data with a single crafted email, without any action by the user.
Revocation. You disable an account and check that the assistant immediately stops reading on its behalf.
Off switch. You check that a single source can be disconnected without stopping the whole service.
Reconstruction. You take a question from the previous week and check that the log makes it possible to trace back the sources, the answer and the identity.

Who decides, and who checks?

In an organisation with several departments, the project holds up if responsibilities are clear from the start.

Decision	Who decides	Who checks
Which sources to connect	Head of the area that produces them	IT and security
Access levels by role	Head of the area, with IT	Acceptance testing with test accounts
Content and retention of the logs	Data controller, with the DPO and legal counsel	Periodic review
Suppliers and data location	Management, on a proposal from IT	Legal counsel and DPO
Suspension in case of anomaly	Head of security	Management, after the fact

In brief

An assistant connected to company systems exposes every permission that is too broad. Cleaning up shared access comes before anything else.
The most robust architecture has the assistant work with the identity of the person asking, and leaves the checks to the source systems.
The log serves security and quality, but it contains personal data. Purposes, access and retention are decided with the DPO and legal counsel.
The route the data takes, sub-processors included, must be written down and checked again with every configuration change.
Acceptance testing covers role-based tests, hidden instructions, access revocation and reconstruction from the log.

Frequently asked questions

Can the assistant show documents that the person could not open?

It depends on the architecture. If the assistant works with the identity of the person asking, it cannot, because the source system’s permissions apply. If it uses a service account with broad access, protection depends on the software filter, which is why this option calls for tougher testing.

How long should question logs be kept?

There is no single period. It is set according to the purposes, the rules that apply and any agreements with employee representatives, on the advice of the data protection officer. For high-risk systems, the AI Act indicates at least six months.

Putting permissions, logs and suppliers in order before an assistant reads company data is the work of our AI security and governance practice. When the goal is to make procedures and documents searchable with a simple question, the same method underpins our Company Brain for organisations, the company’s own searchable memory.

Sources

Sources consulted on 16 September 2026.

Find out moreArtificial intelligence for businessesArtificial intelligence built into the systems your company already uses. We choose the right processes, connect the data, and settle security and rules first.