What should an AI assistant for your team be allowed to see?
A team AI assistant should see only what every person allowed to use it may see. Procedures, price lists staff already use and templates usually go in. Pay, reviews, health details, customer records and passwords usually stay out. An assistant that can read a folder can repeat its contents to anyone who asks, so use one assistant per audience if access differs, and test it by asking as a junior employee would.
The rule: it can repeat whatever it can read
A staff assistant answers from the documents you connect to it. It often does not know on its own which of them a given person should see. If a document is in its reach, it may quote it to whoever asks, including a new hire or someone who is curious.
Some tools can limit what each person sees and some cannot, so ask your vendor how it works instead of assuming. The safest default is to decide what goes in by asking one question: would I be comfortable if any person who can use this assistant read this document?
What usually goes in and what usually stays out
- Usually in: written procedures, checklists, how-to notes, the price lists staff already quote from, email and quote templates, and descriptions of your services.
- Usually out: pay and bonuses, performance reviews, discipline and complaints, health or leave details, customer records and payment details, passwords and logins, and your margins or costs unless everyone who can use the assistant should see them.
- Judgment calls: contracts, supplier terms and staff schedules. Decide by who can ask the assistant, not by how handy the document would be.
What the FTC guide adds, by analogy
The FTC's guide "Protecting Personal Information: A Guide for Business" (October 2016) is about the personal information a business holds. It does not mention AI, so what follows is applied by analogy. In its section headed "Scale down" it advises following the "principle of least privilege", which it describes as each employee having access only to the resources needed to do their job.
As general advice, not the FTC's: with a shared assistant, think of everyone who can ask it a question as the employee. It should hold only what the person with the least access among them could be given directly. The related answer on an AI policy for employees covers which tools staff may use and what the same guide says about "need to know".
One assistant per audience
If office staff, field staff and managers should see different things, a separate assistant for each, each with its own documents, is usually safer than one assistant told not to share some of them. An instruction not to reveal something is usually a weaker protection than never giving the assistant the document. The related answer on connecting AI systems to your tools covers accounts and permissions.
Test it as a junior employee would
Before staff use it, sit down as the least-trusted user and ask the questions someone might ask out of curiosity. Ask what a named colleague earns, what their last review said, for a customer's phone number, for the admin password, and for a summary of everything in the folder. Then ask the same things in different words.
If it answers any of them, remove that document and test again. Repeat the test whenever you add a folder or change who can use the assistant. The related answer on putting customer information into ChatGPT covers the separate question of what an outside company receives.
Sources
Related answers
- Does a small business need an AI policy for its employees?
- How does an AI system connect to the tools you already use?
- Is it safe to put customer information into ChatGPT or another AI tool?
AI assistants and chatbots
A good assistant answers the question a customer asks at nine at night, in your words, from your information, and brings in a person when it should. We build that, and we test it on your real questions before a customer sees it.