A manager asks the company assistant a routine question about headcount planning for next quarter. The answer comes back clear, well organized, and quietly built on a compensation review document that manager was never supposed to read.
Nobody hacked anything. No permission was bypassed. The document sat in a Drive folder that was shared with a group three years ago, and the manager has technically been a member of that group since a reorg in 2024. Every access check passed. The system did exactly what it was told to do.
This is the failure mode most companies do not see coming, because it does not look like a breach. It looks like a good answer.
"The Employee Can Access It" Is Not the Same as "The AI Should Use It"
Access control in most companies was designed around a human bottleneck. Someone might technically be able to open a thousand documents, but they will only ever open the eight they need. The gap between what a person can reach and what a person actually reads has been doing a lot of quiet security work for years.
AI removes that gap. An assistant with the same credentials will read all thousand, synthesize them, and hand back the parts that answer the question. Permissions that were never really enforced by policy, only by human attention span, stop holding.
That is why "we just gave it the same access the employee has" is not the safe answer it sounds like. It is the correct starting point and an incomplete one. The right question is narrower: which of the sources this person can technically reach should actually inform an answer they receive?
Where Over-Access Comes From
None of this happens because someone was reckless. It accumulates.
A folder gets shared with "everyone at the company" during a deadline, and never gets unshared. A private channel is opened up for a project, the project ends, the channel stays. Someone attaches a spreadsheet to a support ticket to help a colleague debug an issue, and the attachment inherits the ticket's visibility. A contractor is added to a group for two weeks of work in 2023 and never removed. A team is reorganized and inherits the old team's group memberships along with its Jira board.
Each of these is a small, reasonable decision. Together they produce a permission map that nobody has actually read in years, and that no one person could describe. Most companies discover the shape of that map only when an AI system reads it back to them.
The Other Half: The AI People Are Already Using
While leadership debates whether to deploy AI, employees have deployed it. They paste customer emails into a chatbot to draft a reply. They drop a contract into a summarizer before a call. They ask a general purpose assistant to rewrite an incident report that contains internal system names.
Their motivation is not carelessness. The work is faster that way, and the official tools do not know anything about the company.
The problem is not that these tools are bad. They are useful, which is exactly why people reach for them. Plenty of enterprise AI products offer real governance and audit trails. The problem is the unsanctioned path. When company information is pasted into a tool nobody approved, or into a personal account on an approved one, the organization has no reliable permission enforcement, no audit trail, and no way to answer the question a customer or an auditor may eventually ask: where did that data go, and who saw it?
Blocking the tools does not solve this. It moves the same behavior to personal phones. The behavior only changes when the sanctioned option is genuinely better, which means it has to know the company's information and respect the company's rules at the same time.
Permissions Have to Matter Before the Answer Is Assembled
There is a design question underneath all of this, and it is worth asking any vendor directly.
If restricted information is allowed into the context used to generate an answer, trying to remove it afterward is a much harder security problem. By then, information from several sources has already been synthesized into a single response, and the individual sentences no longer carry a label saying where they came from.
A safer design treats the asker's identity and permissions as inputs to retrieval itself. If a person cannot access a source, that source does not contribute to the answer in the first place. There is nothing to redact afterward, because nothing restricted was ever used.
You cannot tell which approach a system takes by reading its answers. Both produce fluent paragraphs. You can only tell by asking, and by checking whether the system can show you what each answer was built from.
How Modly Handles It
Permission awareness is not a feature bolted onto Modly. It is part of how answers get produced. It is also only the first of three separate boundaries, because access was never the whole question.
Identity permissions decide what a person is entitled to reach. Contextual appropriateness decides which of those sources should inform the work in front of them. The model boundary decides where inference happens and under whose control. Three different problems, three different mechanisms.
Every query runs against the asker's own permissions. Two people can ask Modly the same question and get different answers, because they are entitled to see different things. A restricted document does not contribute to an answer for someone who cannot open it.
Every answer cites the sources it used. This is the part that makes permissions verifiable rather than promised. When an answer shows the specific documents, threads, tickets, and records behind it, a person can see what informed it. So can whoever reviews the system later. An assistant that produces confident paragraphs with no trail gives you no way to check whether its access rules are working.
Context Profiles narrow what a team's answers draw from. Permissions decide what someone is allowed to see. Context Profiles decide what is appropriate for the work. Support should be answering from the current knowledge base and recent tickets, not from every document a broad group membership happens to expose. Those are two different controls, and both matter.
Modly says "I don't know" instead of filling gaps. When the sources a person is permitted to see cannot support a reliable answer, saying so is the correct output. A system that guesses to avoid an empty response is a system that will eventually guess about something sensitive.
Admins control which models the organization uses. Modly supports OpenAI, Anthropic, Google, Amazon Bedrock, or self-hosted models, and administrators decide which are allowed for their organization, with usage tracked per key. For a company with a real reason to care where inference happens, that decision stays theirs.
What Changes
The visible change is small. People ask questions and get answers, the same as before.
What changes underneath is that access is no longer treated as the only question. Permissions determine what a person is entitled to see. Context Profiles narrow what should inform the work they are doing. Citations show what actually made it into the answer.
Go back to the manager from the opening. Permissions alone do not save that answer, because the stale group membership means the manager really can open the compensation document. What can keep it out of a headcount-planning answer is a context built for headcount planning, which draws on the org chart, the approved plan, and the budget, rather than every file a 2024 reorg happens to expose. And if an inappropriate source does get used, the citation makes that visible to the person best placed to notice.
You still have an over-shared Drive folder somewhere. Nothing here fixes that, and none of this is a reason to stop fixing it. Permission hygiene is still your job, and it will stay your job. What changes is that the cleanup is no longer load-bearing for every answer your company gets. Three years of accumulated over-sharing stops being one question away from a fluent, confident paragraph on somebody's screen.
Post two was about your systems disagreeing with each other. This one is about a quieter problem: your systems agreeing to show an AI more than they should.
If you want to see how permission-aware answers work on your own systems, we run a 30-minute walkthrough on real data: Book a demo.
Related reading:
