How the assistant knows who is allowed to see each document, and keeps up when that changes

Updated November 2026 · About 5 minutes to read · Video, about four minutes

How the assistant knows who may see each document, in about four minutes. Captions are on; the CC button turns them off. Watch on YouTube.

The short answer

When the assistant copies your documents in, it must copy each one's access rules too, and attach them to every passage it makes from that document.

Then it must keep those rules current: when someone changes role, when a file is re-shared, when someone leaves. If the rules are missing or out of date, even a careful check is checking the wrong thing.

Think of a building's keycard system

Each door has a list of who may enter. Each badge belongs to a person in certain teams. When someone moves department, security updates their badge. When they leave, it stops working that day.

Where the picture stops working: the assistant has made its own notes from every file, so each note needs the door list too, and every note has to be updated when the list changes.

Two halves: the document's rules, and the person asking

The document's rules

Your files live in places like SharePoint, Google Drive or a document system, and each keeps a list of who may open each file. When the assistant brings a file in and cuts it into passages, every passage must carry that list.

Watch: some systems apply rules only to a whole folder or collection, not to each file in it.

The person asking

The assistant has to know who is asking, and which teams and groups they belong to, at the moment they ask. That usually comes from the company sign-in your people already use.

Watch: groups inside groups, guests and shared links all need to resolve to the same answer your other systems give.

Assistants built into office suites lean on this directly. Microsoft, for example, says Microsoft 365 Copilot only surfaces data people already have at least view permission for (Microsoft Learn).

Keeping up with changes

Rules change all the time: a file is shared with a new team, a project closes, a manager moves department. Systems keep up in one of two ways.

Check the live rules every time

Each question checks the current rules at the source.

Gives you: changes take effect at once.

Gives up: speed, and it depends on the source being available.

Keep a copy and refresh it

The rules are copied in and refreshed on a schedule, or when the source reports a change.

Gives you: fast answers.

Gives up: a gap between a change and the assistant knowing. What matters is how long, and whether removals are handled first.

What goes wrong

The rules are never copied in. Everyone who can use the assistant can draw on everything in it.
The rules go stale. Someone who changed role keeps seeing their old department's files until the next refresh.
Deleted files linger. A file removed at the source lives on in the assistant's passages until they're removed too.

The most common surprise

Files were shared more widely than anyone realized. The assistant follows those rules faithfully, and finds them in seconds. Microsoft publishes a whole deployment blueprint for oversharing to find and fix this before and during a Copilot rollout.

Questions to ask your IT team or vendor

Does every passage carry its original file's access rules, or only the folder or collection it sits in?
When someone's access is removed, how long until the assistant knows? Minutes, hours, or the next nightly run?
When a file is deleted, are its passages removed everywhere?
Have we reviewed who can open what, before we connect it?
Can we see it tested: change someone's access, then ask the same question again?

Other names you may hear

Access control list (ACL): A file's list of who may open it.
Permission sync: Copying those lists into the assistant and keeping them current.
Identity and groups: Who is asking, and which teams they belong to, usually from the company sign-in.
Document-level security: Rules applied to each document, not just the folder it's in.
Oversharing: Files shared more widely than anyone realized.