Connect an Assistant to Real Documents Without Widening Anyone's Access

T04-L04 · Your documents & knowledge · Level 4 Integrator · 18-minute read, plus 4 hours of doing

The answer that crossed a line

The institute's IT has put the department's document assistant on a server, with the institute login, so every group can ask its own SOPs, the standard operating procedures for its lab work, from any desk. A week later a PhD student in the Orbit group asks about assay timing and gets a paragraph from the Cedar group's unpublished manuscript, with its title as the citation. The document system would never have let him open that file. The assistant did. Its collection, the set of documents it searches, held everything its upload account could read, and everyone who could log in could search it.

In a company it's the sales team trying Microsoft's assistant in Outlook. A sales colleague asks when annual reviews happen this year. The answer quotes a row from a salary-planning spreadsheet on the HR site and names the file. Nobody hacked anything. Three years ago someone shared that folder with the whole company by accident. Nobody ever found it, until the assistant did.

You are at Level 4 Integrator. The assistant now reads your organisation's real document systems, and a mistake shows someone a colleague's salary or an unpublished result. Hiding the citation afterwards doesn't help: the answer has already crossed the line. This book shows you how to connect an assistant so that it never shows anyone more than they were already allowed to see, and how to prove it.

After this you can

• Choose between mirroring each source's permissions and giving each group its own collection, and say why for your sources.
• Find overshared folders, stale group members and over-broad service accounts before you connect anything.
• Connect the assistant with the smallest access that does the job, signed off by IT, the data owners and the data protection officer.
• Prove with two ordinary test accounts that a restricted document can't be surfaced by someone outside its group, in every place it could show up.
• Remove someone's access, measure how long until the assistant stops showing them the document, and know how to stop the connection when a test fails.

Before you start

• Books: T01-L01 for the four-quadrant method. T04-L03 for the test questions and README that check whether answers are right. T02-L04 for what an Open WebUI server keeps and who can reach it.
• The assistant your organisation runs or has approved, with personal logins. The lab example uses Open WebUI, an open-source chat interface, on a server IT runs. The company example uses Microsoft Copilot in Microsoft 365.
• The people who can say yes: IT, who runs the assistant, the login system and the accounts; the data owner of each source, usually the group leader or head of department; and your data protection officer. In a company with a works council, the elected staff representatives, whoever speaks to it.
• Two ordinary test accounts from IT, neither an administrator, one inside the restricted group and one outside it.
• About 4 hours 20 minutes: 18 to read, about 4 hours to do, over two weeks, plus waiting for IT.

Last verified 23 September 2026. Open WebUI is free and updates a person's groups only when they log in. Microsoft Copilot shows each user what they can already open in Microsoft 365; its licence includes tools to find overshared sites. Details for experts at the end of this book.

The idea in one page

A connected assistant passes two gates. The ingest gate decides which documents the assistant's upload account, the account it uses to read documents in, can read and put into its collection. The ask gate decides which of those documents the person asking may see right now. The mistake in both opening stories is the same: passing the first gate was treated as passing the second.

There are two sound ways to keep the ask gate closed.

Mirroring makes old mistakes findable. An assistant that respects permissions perfectly still shows a salary sheet to everyone if the sheet was shared with everyone. Before you switch it on, find what's overshared in the sources and fix it. That's most of the work.

Scoping is only as good as the groups. If the Cedar group in the institute's directory, IT's central list of accounts and groups, still contains two people who left last year, they can search Cedar's collection. Group membership is part of the access, so the group leader reviews it.

Every Level 4 connection needs four answers:

• Least privilege, the smallest access that does the job. The upload account reads only the folders that go in, and can't write. Ordinary users can't manage collections. Two named people in IT are administrators.
• Failure. When a test or a colleague finds a leak, you stop the connection first and investigate second. Write down in advance who stops it and how.
• Sign-off. The data owner decides who may see each source. IT confirms the accounts and groups. The data protection officer decides about personal data, and whether an exposure already happened that needs reporting.
• Undo. You can take a collection offline, remove a document, or switch the assistant off for a site in minutes, and you've practised it once.

Prove what it can't see. A settings page tells you what should happen. The proof is a negative test: a document with a unique marker, found by an account that may see it and invisible to an account that may not. Check every place it could show up: the answer, the citation, the list of collections, the search box. Then remove the authorised account from its group and check again.

Worked example: one boundary, tested from both sides

Both versions follow the four quadrants from T01-L01. Follow the one closer to your work. The people, markers and numbers are examples written for this book.

Lab: group documents on the department's assistant

Structure it (20 min). Jonas, the postdoc from T04-L03, wants his group's SOP assistant on the department's Open WebUI server, which IT runs with the institute login. Two other groups want the same, and the Cedar group also wants to ask its unpublished manuscript drafts. Jonas writes, with IT's service owner: "Each group can ask its own documents from any desk, and nobody sees another group's documents, not even a title. A good result: a test anyone in IT can rerun shows that, and a person who leaves a group loses access within a day."

Understand it (60 min). They start with the sources, not the server. Each group keeps its documents in its own folder on the institute's file service. IT exports three lists: who can read each group folder, who is in each group in the institute's directory, and what the planned upload account could read.

The lists change the plan. Cedar's folder has a subfolder Shared_Collab that a former postdoc opened to the whole department two years ago, and the manuscript drafts are in it. The directory group for Cedar still includes two people who left in the spring and a student assistant from Orbit who helped with one experiment. And the upload account IT had prepared can read the whole file service, because that was quicker to set up.

So Jonas's first idea, one department collection with a note in the instruction saying "only use documents from the asker's group", would have been a leak with a polite request attached. The model doesn't enforce anything; it reads what it's given. Back to Structure it: "One collection per group, filled only from that group's folder, readable only by that group. The folders and groups are cleaned up first, by the people who own them."

Choose tools (15 min).

• Scope the collections. Open WebUI keeps documents in knowledge bases, collections it searches when you ask a question. Each can be set to private and shared with named groups for reading. It doesn't copy the file service's permissions, so mirroring is out, and three stable groups make scoping the simpler choice.
• Groups come from the institute login. Open WebUI can take a person's groups from the login system each time they log in. IT switches that on with one server setting, named in Details for experts, so group membership is managed in one place, the directory, not twice. Open WebUI fills only groups it already has, so IT first creates Cedar, Orbit and Helix in its admin panel with exactly the directory's names.
• A separate upload account per group, with read-only access to that group's folder and nothing else.
• A nightly upload script that IT writes. It sends new and changed files from each folder through Open WebUI's API, its interface for programs, into the right knowledge base.
• The alternative, Onyx, an open-source search assistant with connectors to many document systems, can copy permissions from some sources, but only in its paid edition. For three stable groups, IT prefers one server it already runs.

Build it: clean the sources (60 min, plus waiting). The Cedar group leader moves the manuscript drafts out of Shared_Collab and closes the department-wide share; the one collaborator who needs them gets personal access. All three group leaders review their directory groups; IT removes the leavers and the student assistant. IT replaces the broad upload account with three read-only accounts, one per group folder.

The data protection officer looks at what goes in. The SOPs and manuscripts contain no patient data, but one Cedar draft has a supplementary table with pseudonymised patient codes. That table stays out of the assistant. She also asks that users be told admins can read chats, which the login page now says. The institute's staff council gets the same one-paragraph note.

Build it: connect (40 min). IT creates three knowledge bases under Workspace, then Knowledge, then Create: SOPs Cedar, SOPs Orbit and SOPs Helix. Each one's access setting stays Private, and IT adds only its own group, with read access. A fourth, Department safety, is readable by everyone, as the shared control. Only the two IT administrators can create or change knowledge bases; admin accounts can see every collection, so nobody tests with one. Each night the upload script runs once per group. It reads the group's folder with that group's read-only account, and writes with an Open WebUI service user, an account for a program rather than a person, that may change only that group's knowledge base.

Build it: the negative test (45 min). IT creates two test users in the directory: test-cedar in the Cedar group and test-orbit in Orbit. Jonas puts two small text files in place:

Department safety: marker SAFETY-AMBER-2048 (all groups)
Cedar only: "Cedar test note", marker CEDAR-ULTRAMARINE-4821

A marker is a made-up word that appears nowhere else, so a match can't be a coincidence. After the nightly upload, he logs in as each test user in a fresh private browser window and checks four places: the list of knowledge bases, a question in chat that names the marker, a question that names the title, and the citations under each answer.

The first row matters as much as the others. If test-orbit found nothing at all, the test would prove only that something was broken. The shared marker shows the search works for both; only then does the empty answer mean denied.

One more check catches a trap. Jonas builds an assistant in Open WebUI under Workspace, then Models: a saved model, meaning a model with its own name and instructions, with the Cedar knowledge base attached, and shares the assistant with the whole department by mistake, on purpose. test-orbit can open the assistant, but its answers still contain nothing from Cedar: Open WebUI checks the asker's own access to each attached collection. He writes that down, then removes the share.

Build it: removal (20 min). IT removes test-cedar from the Cedar group in the directory at 10:00. In the window that's still open, test-cedar can still ask Cedar's documents: Open WebUI updates groups only at login. At 10:05 the test user logs out and in again, and Cedar is gone. So the real revocation window is until the next login. IT shortens how long a login lasts from the default four weeks to 12 hours, one more server setting, and adds a step to the leaver checklist: remove the person from the group in Open WebUI's admin panel as well as in the directory. The stated window is now within 12 hours, immediately with the extra step.

Build it: the stop and the record. The README gets a short section, If a test or a colleague finds a leak: an IT administrator opens the affected knowledge base and removes every group from its access list, so it's readable by nobody, which takes one minute; tells the data owner and the data protection officer; and only then investigates. Jonas and IT practise it once on SOPs Helix. The test record, with the table above, the removal times and the sign-offs, goes into the README, and IT reruns the negative test after every change to groups or upload accounts.

Where it stops. Keeping collections fresh, making sure a withdrawn SOP stops being quoted, and logging what was retrieved for whom over months is Level 5 (T04-L05).

What it taught him: the server was the easy part. Two of the three leaks were already in the file service, waiting for something that could find them.

Company: Microsoft Copilot for the sales team

Structure it. Markus, from T04-L03, now leads the pilot of Microsoft Copilot for eight people in sales: drafting replies in Outlook from the price lists and product sheets on SharePoint, the company's document platform. "Sales gets answers from sales and product documents, and never sees HR, finance or management material. A good result: IT can show that with a test before the licences go live."

Understand it. Microsoft Copilot mirrors permissions by design: it shows each person only what they could already open in Microsoft 365. So the question is what the eight people can already open. IT runs the SharePoint admin centre's data access governance reports, reports that list sites shared with very large groups. In the admin centre they're under Reports, then Data access governance; IT starts with the site permissions report, which covers every site. They find three problems. An HR folder with a salary-planning workbook is shared with Everyone except external users, SharePoint's built-in group for every employee. A management site has a sharing link that works for anyone in the company. And a finance site includes a former sales manager who left last year but whose account was never removed from the site.

With a test sales account IT asks Copilot "When are annual reviews this year?" The answer quotes the salary workbook. The people had the access all along; Copilot just found it. Back to Structure it: "Before any licence goes live, fix what's overshared on SharePoint. Copilot comes second."

The data protection officer adds a question of her own: the salary workbook was readable by all 140 employees for three years. Whether that needs reporting as a data breach is her decision, and she makes it with the site's access logs, not with Copilot.

Choose tools. Microsoft Copilot stays, because the company already runs Microsoft 365 and the data never leaves it. To buy time for the cleanup, IT switches on Restricted Content Discovery for the HR, finance and management sites: a site setting that keeps their content out of Copilot answers and company-wide search while owners review access. In the admin centre that's Sites, then Active sites, the site, the Settings tab, and Restrict content from Microsoft Copilot. It doesn't change who can open what, and on large sites it can take days to take effect. The fix itself happens in the sites: the HR site owner removes the company-wide share, the management link is deleted, and the finance site owner removes the leaver.

Build it. IT puts a marker file, HR test note with the marker HR-VERMILION-7314, on the HR site, and a shared control file on the sales site. With the test sales account in a fresh browser window, they ask Copilot in Outlook, in Word and in Copilot Chat for the marker and the title. The control is found in all three; the HR marker in none. A test HR account finds both. Then IT removes the test HR account from the HR site's members and measures: after 40 minutes Copilot stops returning the marker. The stated window goes into the record: within two hours.

The works council agrees to the pilot on one condition: Copilot's usage reports stay switched to team level, without names. The eight licences go live, and the negative test runs again every quarter and after every change to the HR or finance sites.

In both cases the assistant only did what its design promised. What the design couldn't do was fix access that had been wrong for years. The negative test found that before a colleague did.

What goes wrong

The upload account's reach becomes everyone's. Symptom: documents appear in answers for people who could never open them in the source. Fix: scope each collection to what all its readers may see, or use a connector that mirrors permissions. Give each upload account read-only access to its own folder only.

The instruction is the lock. Symptom: the setup relies on a line such as "only answer from the asker's group". Fix: the model enforces nothing. Access is decided by collections, groups and source permissions; the instruction only shapes the answer.

Old oversharing, newly findable. Symptom: a mirroring assistant shows HR or finance files to everyone, and permissions look "correct". Fix: run the oversharing reports before switching on, fix the sites with their owners, and keep sensitive sites out of the assistant until they're fixed.

Groups nobody reviews. Symptom: people who left, or helped once, still search a group's collection. Fix: the data owner reviews group membership before connecting and twice a year after. Leavers are removed in the directory and in the assistant.

An empty answer counted as a pass. Symptom: the outside account finds nothing, but the connector was broken and nobody could find anything. Fix: always test a shared control marker in the same session. Only a working control makes an empty answer mean denied.

Testing only the answer. Symptom: the chat refuses, but the collection list or the citation shows the restricted title. Fix: check every place: collection lists, search, answers, titles and citations.

Revocation that waits for a login. Symptom: someone removed from a group keeps access for days. Fix: measure the real window with a test account, shorten login length where needed, and add the assistant to the leaver checklist.

Do it yourself (4 hours, over two weeks)

1. Structure it (20 min). Write one sentence per source: who may ask it, who must never see it, and how fast access must end when someone leaves.
2. Understand it (60 min). Ask IT for three lists: who can read each source, who is in each group, and what the planned upload account can read. For a mirroring assistant, run the oversharing reports. Mark every surprise.
3. Choose tools (15 min). Pick mirroring or scoping for each source and write why the other doesn't fit. Name the upload accounts and their read-only scope. Decide how you'll stop the connection in minutes.
4. Build it: clean and connect (80 min, plus waiting). Have data owners fix shares and group membership. Get IT's and the data protection officer's sign-off in writing. Connect with the smallest access, and keep sensitive sources out until they're clean.
5. Build it: prove and practise (60 min). With two ordinary test accounts, a shared control and a restricted marker, check every place the marker could show up. Remove the authorised account from its group and time the change. Practise the stop once. Write the test record into the README and set a date for the next rerun.

Exit check

Passing test: a permission test record for one connected source, containing:

• the access model, mirroring or scoping, and why the other doesn't fit;
• the sign-offs from the data owner, IT and the data protection officer, with what each confirmed;
• the accounts and groups: two ordinary test accounts, neither an administrator, and their groups;
• the results for the shared control and the restricted marker, for both accounts, in every place checked;
• the removal test: when the authorised account was removed, when the assistant stopped showing the marker, and the window you state;
• the stop procedure, and the date you practised it.

It passes when the outside account surfaces no marker, title, snippet or citation anywhere, the shared control works for both accounts, and the removal took effect within the stated window.

Rule to remember

Prove what the assistant can't show, not only what it can.

Details for experts

Checked on 23 September 2026. You don't need this to follow the book; it's for setting things up or answering a colleague.

Further reading and tools

Next books

• T04-L03 · Test and Fix the Document Assistant Your Group Relies On: checking that answers are right before you check who sees them.
• T04-L05: keeping connected collections fresh, withdrawing documents and logging retrieval over months.
• T02-L04 · A Self-Hosted Assistant Your Team Can Use Safely: what the Open WebUI server keeps and who can reach it.
• T12-L04: securing the server, accounts and keys around it.
• T14-L03 · Turn a Connector Brief Into a Routine Colleagues Can Rerun: connecting other systems beyond documents.

Tools

• Open WebUI: Taught. The department's assistant, with one knowledge base per group.
• Microsoft Copilot: Taught. The company's assistant, mirroring SharePoint permissions.
• Onyx: Catalogued. The alternative that can copy permissions from connected sources.
• AnythingLLM: Catalogued. The single-PC assistant from T04-L03, before it needed personal logins.