Who can see what: the question small companies never ask
When you connect an assistant to your files, it inherits somebody’s permissions. In most Swiss SMEs, nobody knows whose.
The most common serious mistake we see is not a leak to an outside provider. It is an internal one: an assistant connected to company documents, answering questions for people who should not have those answers.
How it happens, without anyone doing anything wrong
Someone connects an assistant to the shared drive so it can answer questions about company documents. That is a reasonable thing to want.
The connection is made using an administrator account, because that is the account that could see everything and therefore the one that worked. Now every employee asking the assistant a question is, in effect, asking with administrator eyes.
Salary letters, disciplinary records, the folder from the acquisition talks in 2023. None of it was deliberately exposed; the permissions were simply inherited from whoever set it up.
The test, which takes four minutes
Ask the assistant, from a normal employee account, a question whose answer sits in a folder that employee cannot open. « What does the 2024 management agreement say about notice periods? » is the shape of it.
If it answers, you have the problem. If it says it cannot find anything, you probably do not.
Do this yourself, from a colleague’s login with their knowledge, rather than asking a vendor whether it is configured correctly.
The fix
The assistant should see what the person asking can see, not what the person who installed it can see. Any serious business product supports this; it is often not the default because the default is whatever made the demonstration work.
If your product cannot do it, that is a significant finding and worth a direct conversation with the supplier.
Why January
Because you have just named the person who decides, and this is a good first exercise for them: concrete, four minutes, and it produces either relief or a finding that justifies the role immediately.