Who should see what: access rules for AI in a company of thirty
A tool that answers questions from your documents inherits whatever access it is given. In a small company that is usually everything.
Here is the problem in one sentence. If you give an AI assistant access to your file server so it can answer questions about your documents, it can answer questions about all of them — including the salary folder, the lawyer’s letter and the draft reorganisation.
In a company of thirty, this arrives faster than anyone expects, because the person setting it up is also the person who has access to everything.
Why small companies get this wrong
Not carelessness. Structure. In a thirty-person firm the managing director, the office manager and the IT contact often have full access, and nothing bad has ever come of it, because a human with full access still has to go looking.
Retrieval removes the looking. A question that nobody would have thought to ask by opening folders gets asked casually, in natural language, and answered.
Nothing was breached. The access was always there. What changed is that it became easy to use.
The three-tier rule that fits an SME
- Open. Product documentation, standard terms, price lists, process descriptions, technical data. This is where the value is and where nearly all the questions come from. Index it, let everyone ask.
- Restricted. Customer files, project margins, supplier agreements. Indexed, but only reachable by the people who already work with them.
- Never indexed. Personnel files, salary data, health information, legal correspondence, anything about a reorganisation. Not « restricted » — excluded. The cost of getting tier two wrong is embarrassment; the cost of getting tier three wrong is an employment dispute.
The practical test before you switch anything on
Ask the system three questions you would not want answered: what a named colleague earns, what the pending legal matter is about, what the margin on your largest customer is.
If it answers any of them, you have found your problem before your staff did. If it refuses or finds nothing, note the date and the questions you asked, and repeat the test after every change to what is indexed.
Five minutes, and it is the only part of an AI rollout in a small company that can genuinely damage trust internally.