Connect an Assistant to Real Documents Without Widening Anyone's Access | Heidelberg AI Curriculum
T04-L04
Connect an Assistant to Real Documents Without Widening Anyone's Access
An assistant connected to your document system can show anyone what they could open but never found, or what they should never see. Choose how access is decided, clean up the sources first, connect with the least access, and prove with two test accounts that a restricted document stays hidden.
T04-L04 · Your documents & knowledge · Level 4 Integrator · 18-minute read, plus 4 hours of doing
The answer that crossed a line
The institute's IT has put the department's document assistant on a server, with the institute login, so every group can ask its own SOPs, the standard operating procedures for its lab work, from any desk. A week later a PhD student in the Orbit group asks about assay timing and gets a paragraph from the Cedar group's unpublished manuscript, with its title as the citation. The document system would never have let him open that file. The assistant did. Its collection, the set of documents it searches, held everything its upload account could read, and everyone who could log in could search it.
In a company it's the sales team trying Microsoft's assistant in Outlook. A sales colleague asks when annual reviews happen this year. The answer quotes a row from a salary-planning spreadsheet on the HR site and names the file. Nobody hacked anything. Three years ago someone shared that folder with the whole company by accident. Nobody ever found it, until the assistant did.
You are at Level 4 Integrator. The assistant now reads your organisation's real document systems, and a mistake shows someone a colleague's salary or an unpublished result. Hiding the citation afterwards doesn't help: the answer has already crossed the line. This book shows you how to connect an assistant so that it never shows anyone more than they were already allowed to see, and how to prove it.
After this you can
Choose between mirroring each source's permissions and giving each group its own collection, and say why for your sources.
Find overshared folders, stale group members and over-broad service accounts before you connect anything.
Connect the assistant with the smallest access that does the job, signed off by IT, the data owners and the data protection officer.
Prove with two ordinary test accounts that a restricted document can't be surfaced by someone outside its group, in every place it could show up.
Remove someone's access, measure how long until the assistant stops showing them the document, and know how to stop the connection when a test fails.
The assistant your organisation runs or has approved, with personal logins. The lab example uses Open WebUI, an open-source chat interface, on a server IT runs. The company example uses Microsoft Copilot in Microsoft 365.
The people who can say yes: IT, who runs the assistant, the login system and the accounts; the data owner of each source, usually the group leader or head of department; and your data protection officer. In a company with a works council, the elected staff representatives, whoever speaks to it.
Two ordinary test accounts from IT, neither an administrator, one inside the restricted group and one outside it.
About 4 hours 20 minutes: 18 to read, about 4 hours to do, over two weeks, plus waiting for IT.
Last verified 23 September 2026. Open WebUI is free and updates a person's groups only when they log in. Microsoft Copilot shows each user what they can already open in Microsoft 365; its licence includes tools to find overshared sites. Details for experts at the end of this book.
The idea in one page
A connected assistant passes two gates. The ingest gate decides which documents the assistant's upload account, the account it uses to read documents in, can read and put into its collection. The ask gate decides which of those documents the person asking may see right now. The mistake in both opening stories is the same: passing the first gate was treated as passing the second.
There are two sound ways to keep the ask gate closed.
Mirror the permissions
Scope the collection
How it works
The assistant reads widely, but copies each document's access list from the source and checks it for every question.
Each collection holds only documents that everyone who may search it is allowed to read. Separate groups get separate collections.
Pick it when
Access is mixed and changes often, and the assistant is built into the document system or has a connector, a plug-in that reads a document system, that copies permissions.
Access follows a few stable groups, and the tool can't copy permissions reliably.
Where it breaks
Whatever is overshared in the source is now easy to find.
Someone drops a restricted file into a "shared" folder.
Example
Microsoft Copilot over SharePoint, Microsoft's document platform
One Open WebUI collection per research group
Mirroring makes old mistakes findable. An assistant that respects permissions perfectly still shows a salary sheet to everyone if the sheet was shared with everyone. Before you switch it on, find what's overshared in the sources and fix it. That's most of the work.
Scoping is only as good as the groups. If the Cedar group in the institute's directory, IT's central list of accounts and groups, still contains two people who left last year, they can search Cedar's collection. Group membership is part of the access, so the group leader reviews it.
Every Level 4 connection needs four answers:
Least privilege, the smallest access that does the job. The upload account reads only the folders that go in, and can't write. Ordinary users can't manage collections. Two named people in IT are administrators.
Failure. When a test or a colleague finds a leak, you stop the connection first and investigate second. Write down in advance who stops it and how.
Sign-off. The data owner decides who may see each source. IT confirms the accounts and groups. The data protection officer decides about personal data, and whether an exposure already happened that needs reporting.
Undo. You can take a collection offline, remove a document, or switch the assistant off for a site in minutes, and you've practised it once.
Prove what it can't see. A settings page tells you what should happen. The proof is a negative test: a document with a unique marker, found by an account that may see it and invisible to an account that may not. Check every place it could show up: the answer, the citation, the list of collections, the search box. Then remove the authorised account from its group and check again.
Worked example: one boundary, tested from both sides
Lab: group documents on the department's assistant
Structure it (20 min). Jonas, the postdoc from T04-L03 · Test and Fix the Document Assistant Your Group Relies On, wants his group's SOP assistant on the department's Open WebUI server, which IT runs with the institute login. Two other groups want the same, and the Cedar group also wants to ask its unpublished manuscript drafts. Jonas writes, with IT's service owner: "Each group can ask its own documents from any desk, and nobody sees another group's documents, not even a title. A good result: a test anyone in IT can rerun shows that, and a person who leaves a group loses access within a day."
Understand it (60 min). They start with the sources, not the server. Each group keeps its documents in its own folder on the institute's file service. IT exports three lists: who can read each group folder, who is in each group in the institute's directory, and what the planned upload account could read.
The lists change the plan. Cedar's folder has a subfolder Shared_Collab that a former postdoc opened to the whole department two years ago, and the manuscript drafts are in it. The directory group for Cedar still includes two people who left in the spring and a student assistant from Orbit who helped with one experiment. And the upload account IT had prepared can read the whole file service, because that was quicker to set up.
So Jonas's first idea, one department collection with a note in the instruction saying "only use documents from the asker's group", would have been a leak with a polite request attached. The model doesn't enforce anything; it reads what it's given. Back to Structure it: "One collection per group, filled only from that group's folder, readable only by that group. The folders and groups are cleaned up first, by the people who own them."
Choose tools (15 min).
Scope the collections. Open WebUI keeps documents in knowledge bases, collections it searches when you ask a question. Each can be set to private and shared with named groups for reading. It doesn't copy the file service's permissions, so mirroring is out, and three stable groups make scoping the simpler choice.
Groups come from the institute login. Open WebUI can take a person's groups from the login system each time they log in. IT switches that on with one server setting, named in Details for experts, so group membership is managed in one place, the directory, not twice. Open WebUI fills only groups it already has, so IT first creates Cedar, Orbit and Helix in its admin panel with exactly the directory's names.
A separate upload account per group, with read-only access to that group's folder and nothing else.
A nightly upload script that IT writes. It sends new and changed files from each folder through Open WebUI's API, its interface for programs, into the right knowledge base.
The alternative, Onyx, an open-source search assistant with connectors to many document systems, can copy permissions from some sources, but only in its paid edition. For three stable groups, IT prefers one server it already runs.
Build it: clean the sources (60 min, plus waiting). The Cedar group leader moves the manuscript drafts out of Shared_Collab and closes the department-wide share; the one collaborator who needs them gets personal access. All three group leaders review their directory groups; IT removes the leavers and the student assistant. IT replaces the broad upload account with three read-only accounts, one per group folder.
The data protection officer looks at what goes in. The SOPs and manuscripts contain no patient data, but one Cedar draft has a supplementary table with pseudonymised patient codes. That table stays out of the assistant. She also asks that users be told admins can read chats, which the login page now says. The institute's staff council gets the same one-paragraph note.
Build it: connect (40 min). IT creates three knowledge bases under Workspace, then Knowledge, then Create: SOPs Cedar, SOPs Orbit and SOPs Helix. Each one's access setting stays Private, and IT adds only its own group, with read access. A fourth, Department safety, is readable by everyone, as the shared control. Only the two IT administrators can create or change knowledge bases; admin accounts can see every collection, so nobody tests with one. Each night the upload script runs once per group. It reads the group's folder with that group's read-only account, and writes with an Open WebUI service user, an account for a program rather than a person, that may change only that group's knowledge base.
Build it: the negative test (45 min). IT creates two test users in the directory: test-cedar in the Cedar group and test-orbit in Orbit. Jonas puts two small text files in place:
Department safety: marker SAFETY-AMBER-2048 (all groups)
Cedar only: "Cedar test note", marker CEDAR-ULTRAMARINE-4821
A marker is a made-up word that appears nowhere else, so a match can't be a coincidence. After the nightly upload, he logs in as each test user in a fresh private browser window and checks four places: the list of knowledge bases, a question in chat that names the marker, a question that names the title, and the citations under each answer.
Check
test-cedar
test-orbit
Sees Department safety, finds SAFETY-AMBER-2048
yes
yes
Sees SOPs Cedar in the list
yes
no
Finds CEDAR-ULTRAMARINE-4821 in chat, with citation
yes
no marker, no title, no citation
Asks for "Cedar test note" by title
found
nothing, no hint it exists
The first row matters as much as the others. If test-orbit found nothing at all, the test would prove only that something was broken. The shared marker shows the search works for both; only then does the empty answer mean denied.
One more check catches a trap. Jonas builds an assistant in Open WebUI under Workspace, then Models: a saved model, meaning a model with its own name and instructions, with the Cedar knowledge base attached, and shares the assistant with the whole department by mistake, on purpose. test-orbit can open the assistant, but its answers still contain nothing from Cedar: Open WebUI checks the asker's own access to each attached collection. He writes that down, then removes the share.
Build it: removal (20 min). IT removes test-cedar from the Cedar group in the directory at 10:00. In the window that's still open, test-cedar can still ask Cedar's documents: Open WebUI updates groups only at login. At 10:05 the test user logs out and in again, and Cedar is gone. So the real revocation window is until the next login. IT shortens how long a login lasts from the default four weeks to 12 hours, one more server setting, and adds a step to the leaver checklist: remove the person from the group in Open WebUI's admin panel as well as in the directory. The stated window is now within 12 hours, immediately with the extra step.
Build it: the stop and the record. The README gets a short section, If a test or a colleague finds a leak: an IT administrator opens the affected knowledge base and removes every group from its access list, so it's readable by nobody, which takes one minute; tells the data owner and the data protection officer; and only then investigates. Jonas and IT practise it once on SOPs Helix. The test record, with the table above, the removal times and the sign-offs, goes into the README, and IT reruns the negative test after every change to groups or upload accounts.
What it taught him: the server was the easy part. Two of the three leaks were already in the file service, waiting for something that could find them.
Company: Microsoft Copilot for the sales team
Structure it. Markus, from T04-L03 · Test and Fix the Document Assistant Your Group Relies On, now leads the pilot of Microsoft Copilot for eight people in sales: drafting replies in Outlook from the price lists and product sheets on SharePoint, the company's document platform. "Sales gets answers from sales and product documents, and never sees HR, finance or management material. A good result: IT can show that with a test before the licences go live."
Understand it. Microsoft Copilot mirrors permissions by design: it shows each person only what they could already open in Microsoft 365. So the question is what the eight people can already open. IT runs the SharePoint admin centre's data access governance reports, reports that list sites shared with very large groups. In the admin centre they're under Reports, then Data access governance; IT starts with the site permissions report, which covers every site. They find three problems. An HR folder with a salary-planning workbook is shared with Everyone except external users, SharePoint's built-in group for every employee. A management site has a sharing link that works for anyone in the company. And a finance site includes a former sales manager who left last year but whose account was never removed from the site.
With a test sales account IT asks Copilot "When are annual reviews this year?" The answer quotes the salary workbook. The people had the access all along; Copilot just found it. Back to Structure it: "Before any licence goes live, fix what's overshared on SharePoint. Copilot comes second."
The data protection officer adds a question of her own: the salary workbook was readable by all 140 employees for three years. Whether that needs reporting as a data breach is her decision, and she makes it with the site's access logs, not with Copilot.
Choose tools. Microsoft Copilot stays, because the company already runs Microsoft 365 and the data never leaves it. To buy time for the cleanup, IT switches on Restricted Content Discovery for the HR, finance and management sites: a site setting that keeps their content out of Copilot answers and company-wide search while owners review access. In the admin centre that's Sites, then Active sites, the site, the Settings tab, and Restrict content from Microsoft Copilot. It doesn't change who can open what, and on large sites it can take days to take effect. The fix itself happens in the sites: the HR site owner removes the company-wide share, the management link is deleted, and the finance site owner removes the leaver.
Build it. IT puts a marker file, HR test note with the marker HR-VERMILION-7314, on the HR site, and a shared control file on the sales site. With the test sales account in a fresh browser window, they ask Copilot in Outlook, in Word and in Copilot Chat for the marker and the title. The control is found in all three; the HR marker in none. A test HR account finds both. Then IT removes the test HR account from the HR site's members and measures: after 40 minutes Copilot stops returning the marker. The stated window goes into the record: within two hours.
The works council agrees to the pilot on one condition: Copilot's usage reports stay switched to team level, without names. The eight licences go live, and the negative test runs again every quarter and after every change to the HR or finance sites.
In both cases the assistant only did what its design promised. What the design couldn't do was fix access that had been wrong for years. The negative test found that before a colleague did.
What goes wrong
The upload account's reach becomes everyone's.Symptom: documents appear in answers for people who could never open them in the source. Fix: scope each collection to what all its readers may see, or use a connector that mirrors permissions. Give each upload account read-only access to its own folder only.
The instruction is the lock.Symptom: the setup relies on a line such as "only answer from the asker's group". Fix: the model enforces nothing. Access is decided by collections, groups and source permissions; the instruction only shapes the answer.
Old oversharing, newly findable.Symptom: a mirroring assistant shows HR or finance files to everyone, and permissions look "correct". Fix: run the oversharing reports before switching on, fix the sites with their owners, and keep sensitive sites out of the assistant until they're fixed.
Groups nobody reviews.Symptom: people who left, or helped once, still search a group's collection. Fix: the data owner reviews group membership before connecting and twice a year after. Leavers are removed in the directory and in the assistant.
An empty answer counted as a pass.Symptom: the outside account finds nothing, but the connector was broken and nobody could find anything. Fix: always test a shared control marker in the same session. Only a working control makes an empty answer mean denied.
Testing only the answer.Symptom: the chat refuses, but the collection list or the citation shows the restricted title. Fix: check every place: collection lists, search, answers, titles and citations.
Revocation that waits for a login.Symptom: someone removed from a group keeps access for days. Fix: measure the real window with a test account, shorten login length where needed, and add the assistant to the leaver checklist.
Do it yourself (4 hours, over two weeks)
Structure it (20 min). Write one sentence per source: who may ask it, who must never see it, and how fast access must end when someone leaves.
Understand it (60 min). Ask IT for three lists: who can read each source, who is in each group, and what the planned upload account can read. For a mirroring assistant, run the oversharing reports. Mark every surprise.
Choose tools (15 min). Pick mirroring or scoping for each source and write why the other doesn't fit. Name the upload accounts and their read-only scope. Decide how you'll stop the connection in minutes.
Build it: clean and connect (80 min, plus waiting). Have data owners fix shares and group membership. Get IT's and the data protection officer's sign-off in writing. Connect with the smallest access, and keep sensitive sources out until they're clean.
Build it: prove and practise (60 min). With two ordinary test accounts, a shared control and a restricted marker, check every place the marker could show up. Remove the authorised account from its group and time the change. Practise the stop once. Write the test record into the README and set a date for the next rerun.
Exit check
Passing test: a permission test record for one connected source, containing:
the access model, mirroring or scoping, and why the other doesn't fit;
the sign-offs from the data owner, IT and the data protection officer, with what each confirmed;
the accounts and groups: two ordinary test accounts, neither an administrator, and their groups;
the results for the shared control and the restricted marker, for both accounts, in every place checked;
the removal test: when the authorised account was removed, when the assistant stopped showing the marker, and the window you state;
the stop procedure, and the date you practised it.
It passes when the outside account surfaces no marker, title, snippet or citation anywhere, the shared control works for both accounts, and the removal took effect within the stated window.
Rule to remember
Prove what the assistant can't show, not only what it can.
Details for experts
Checked on 23 September 2026. You don't need this to follow the book; it's for setting things up or answering a colleague.
What
Details
What it means for you
Open WebUI
Current release v0.11.4, 21 September 2026. Knowledge bases can be private with read or write access granted to groups or single users; public means read access for every signed-in user. Permissions from several groups add up, never subtract. When a model has knowledge attached, each asker's own access to it is still checked.
Test with ordinary accounts; one broad group grant can't be cancelled by another group.
Groups from the login
ENABLE_OAUTH_GROUP_MANAGEMENT=true syncs groups from the login system (OAuth or OIDC, the standards behind "log in with your institute account") at each login; OAUTH_GROUP_CLAIM names the field holding the groups, default groups. An absent or empty field leaves memberships unchanged. Groups must already exist in Open WebUI unless ENABLE_OAUTH_GROUP_CREATION is on. JWT_EXPIRES_IN sets how long a login lasts, default 4w. With sync on, users are removed from Open WebUI groups missing from their login, including admins.
Removal takes effect at the next login. Make sure the login always sends the groups field.
Microsoft Copilot
Microsoft 365 Copilot is now named Microsoft Copilot. It "only surfaces organizational data to which individual users have at least view permissions".
Oversharing in SharePoint becomes oversharing in answers.
Restricted Content Discovery
Site setting Restrict content from Microsoft Copilot in the SharePoint admin centre. Doesn't change permissions; meant as a temporary measure during reviews. Sites with more than 500,000 items can take over a week to update.
Use it on HR and finance sites while owners clean up, then remove it.
SharePoint Advanced Management
Included once at least one user has a Microsoft Copilot licence, for enterprise and business customers alike (Microsoft's page on SAM in Copilot licences). Its data access governance reports cover site permissions, sharing links and content shared with Everyone except external users; activity reports look back 28 days.
Ask IT to open Reports, Data access governance in the SharePoint admin centre before the first licence goes live.
Onyx
Open-source search assistant; copying permissions from sources and custom group permissions are in its Enterprise Edition.
The alternative when you need mirroring from many systems.
Microsoft 365 Copilot - Small Business Guide to Prepare your Data for Search
Microsoft 365 Copilot - Small Business Guide to Prepare your Data for SearchMicrosoft Mechanics
T04-L04: See how to find overshared SharePoint documents with a low-privilege account, tighten access and check again with another account. This historical Microsoft demonstration is not current licensing advice or proof that your configuration is secure.
T13-L04: Use a low-privilege test account to investigate what colleagues could discover before a Copilot rollout. This 2024 Microsoft demonstration explains the check, not current licensing or your organisation's consultation requirements.
