One of the most common security failures in workplace AI use is not a sophisticated attack. It is a capable person, under time pressure, pasting sensitive material into the wrong window.
The everyday cases
The personal or unapproved account. Someone uses an account their employer has not approved because the approved tool is slow, restricted or does not exist. Consumer, free, business and enterprise accounts can operate under materially different data-use, retention, administrative and contractual controls. Never infer those controls from the price of the account. An account IT cannot see also cannot be audited or revoked when the person leaves. Check the terms and settings for the exact service and account you are using.
The shared link. A shared conversation may no longer be private to the people you intended. Depending on the product, anyone with the link may be able to access it, links may continue working after circumstances change, and organizational controls may be limited. Treat shared AI conversations the way you would treat externally shared documents.
The connector. Granting an assistant access to email, calendar or files can grant broad standing access, sometimes much wider than the item involved in the immediate task. Every connector is a standing data path. Review what is connected the way you would review who has access to a shared drive.
The browser extension and the meeting bot. An AI helper that "reads the page" may be able to read page content across the sites or pages covered by its permissions, including internal portals. A note-taker that joins a call may record or transcribe participants, creating notification, consent and retention obligations. Both are frequently installed by individuals with no review.
The feature that was already on. Assistants are appearing inside existing office, email, chat and coding products, sometimes enabled by default. Many people are using AI on work data without having decided to. Find out what is switched on in the tools you already have.
The country the data lands in. Where a provider stores and processes data affects confidentiality obligations, regulatory exposure and government access. Some services are explicit about this, while others are not. If you handle client, personal or regulated data, this is not optional homework.
The credential in the log. Developers paste error output containing tokens, keys and connection strings. Redacting the customer email and leaving the key is the usual pattern. The debugging example later in this chapter shows the safer route.
Five questions before you paste
1. What is this material's classification: public, internal, confidential, personal, regulated?
2. Which account am I logged into, and who owns it, me or my employer?
3. Has my employer approved this account for this classification? If there is no policy or approval process, treat approval as unresolved rather than assuming the use is acceptable, and ask whoever owns the data or the risk.
4. Where does this go after the model: logs, training, connectors, stored history, shared links?
5. Could I do the same test with a public or made-up example first?
If any answer is "I don't know," use synthetic material and get the real answer from whoever owns the data. Learning should never cost a disclosure.
When your organization has no policy
Absence of a policy is not permission. It usually means nobody has been asked. Ask, in writing, naming a specific tool, a specific data class and a specific task. That request is far more likely to produce a decision than a general "can we use AI." It also establishes that you asked.
Outbound risk: what you send onward
The data-boundary conversation usually stops at input. The other direction matters as much.
- A memo with an invented citation sent to a client is your error, not the tool's.
- Generated code may carry license obligations or vulnerabilities you did not write and did not review.
- Ownership of AI-generated output varies by jurisdiction and by service terms. Assume nothing until you have checked.
- A confident AI summary forwarded without the source becomes a new fact in your organization's record. Attach the source or do not forward it.
Follow the complete route: device, application, model provider, retrieval service, tool provider, monitoring system and stored conversation. Each recipient can introduce a separate retention or access decision. “Not used for training” is narrower than “not retained,” and neither tells you who can inspect operational logs. [2]
| Deployment choice | Responsibility to resolve |
|---|---|
| Consumer account | Whether its terms and controls are approved for this data and purpose |
| Business or enterprise service | Identity, sharing, retention, regional processing and connector configuration |
| Model API | Application logs, secrets, user authorization and every downstream processor |
| Private cloud deployment | Network isolation, service configuration, operational access and incident response |
| Local inference | Model provenance, endpoint exposure, device security, backups and external integrations |
A production debugging request. A developer wants help with a failing payment request. The copied log includes a customer email, a bearer token and a database connection string. Removing the email alone leaves the most actionable secrets exposed. The developer instead creates a minimal failing example with synthetic identifiers, removes credentials and uses the approved coding environment. Any credential already disclosed follows the organization's incident process, including revocation where appropriate.
The useful output is a hypothesis tied to the sanitized trace and a test that can disprove it. The developer reviews the proposed patch and runs relevant tests in an isolated environment. A plausible explanation does not authorize access to production or deployment of the patch.
Local inference can reduce external disclosure when the full workflow stays local. A local model paired with a remote search tool, cloud telemetry or synchronized chat history has a broader data path. Verify the workflow you are running, not the label on the model.