Search is an obvious first job for an AI agent. Someone asks a question in plain words. The agent reads the policies, contracts, minutes and email it can reach, and writes an answer. Years of knowledge become easy to use.

The flaw is quiet. To read widely, the agent is often given wide access. Then a new salesperson asks what the business pays its largest suppliers, and gets an answer drawn from a board pack they were never meant to open. Nothing was hacked. The agent did what it was set up to do.

This piece is for the chief information officer (CIO) or Head of IT who is about to connect AI agents to the shared drives, mailboxes and systems the business runs on, and who will later be asked who saw what.

Why a wide-access search fails

  1. The answer slips past the folder. File permissions stop a person opening the HR folder. They do nothing once an agent that can open it has summarised it into a reply. The lock was on the document. The leak happens in the answer.
  2. Old oversharing comes to light. A folder shared with everyone years ago stays harmless only while nobody goes looking. An AI agent looks everywhere it can reach, every time it is asked.
  3. One index, many readers. AI search often works from a searchable copy of your documents. If that copy does not keep each document's access rules, everyone who asks is searching the same pile.
  4. The record names the agent, not the reader. If the agent searched with its own account, the log shows that the agent read the salary file. It does not show who asked, or who saw the answer.

The rule: search as the person asking

When an AI agent answers a person, it should find only what that person could open themselves, checked at the moment they ask.

This sits alongside the agent's own identity. An agent doing its own job works under its own account, with only the access that job needs. An agent answering someone works inside that person's access as well. The agent's access sets the outer limit. The asker's access decides what this answer may contain.

Security guidance for AI systems points the same way: limit access to sensitive data to what each user needs, and keep the searchable store aware of permissions.

What good looks like

This is the design in plain terms, not a build manual.

  • Access rules travel with the knowledge. Every piece of the searchable copy keeps the rules of the document it came from.
  • Access is checked when someone asks, not when the copy was made. A person who loses access to a folder cannot find it through the agent the next time they ask.
  • Sensitive sources are added on purpose. Payroll, board papers, legal matters and personal information join search only when a named owner says yes.
  • Every answer names its sources. The reader can see which documents shaped it, and so can anyone who reviews it later.
  • The record names both sides. Who asked, which agent answered, and which documents it read.

Where this gets harder than it sounds

Clean up before you connect. An AI agent will surface whatever is already overshared. Review what is open to everyone before search goes live. It is easier to fix a folder before people have read the answers than after.

Some systems have no fine-grained access. An older system with one shared login cannot pass its rules along, because it has none to pass. Keep it out of general search, or open it only to a named group, until it can.

One answer, many documents. A summary can blend an open document with a restricted one. Every source in the answer must pass the asker's check, not just the first.

Answers get shared. A reply one person was allowed to see can be pasted into a team channel. Treat a saved or forwarded answer with the same care as the documents behind it.

Five questions to ask before AI search goes live

  1. When an agent answers someone, whose access does it search with?
  2. If a person loses access to a folder, when does the agent stop showing it to them?
  3. Which sources are in search, and who decided that each sensitive one should be?
  4. Have we reviewed what is shared with everyone before connecting it?
  5. For any answer, can we see who asked, which agent answered and which documents it read?

If the answer to the first question is "the agent's own account", the search is not ready for the whole business, however well it did in the demo.

Knowledge is only aligned if access is too

AI agents make a business's knowledge easy to find. That is the point, and it is why access must be designed first. Search as the asker, keep the rules on the knowledge, and record who saw what. Then people can trust what the agent tells them, and so can the people whose information it holds.

At Futuvara, we build, implement and run AI platforms where AI agents do defined work under rules your business sets. If you are about to open your company's knowledge to AI agents and want to talk through who should see what, start a conversation.

Start an Agentic conversation →

Sources:

  1. OWASP GenAI Security Project, LLM08:2025 Vector and Embedding Weaknesses (recommends "permission-aware vector and embedding stores")
  2. OWASP GenAI Security Project, LLM02:2025 Sensitive Information Disclosure (recommends limiting access to sensitive data "based on the principle of least privilege")