Letting associates see their own information, safely
Someone will soon ask to connect their AI assistant to your systems. The nervousness that comes with that is the right instinct, and there is a clear answer to it.
Your associates and contractors ask the office the same handful of questions. What am I doing next week. Where is it. How many days have I done for that client.
Someone stops what they are doing, looks it up, replies. None of it is difficult and all of it is interruption.
The request that is coming
More and more people now start the working day inside an AI assistant rather than inside a system. They do not log in, they ask.
Fairly soon, "can I connect my assistant to your system" will be as ordinary a request as "can you give me a login" is today. It will come from associates, from contractors, and from clients.
Most businesses have no answer ready for it.
What it looks like when it works
I built this, so I am describing something real rather than something I imagine.
Someone signs in once, using the email address you already hold for them. Then they ask in plain English and get an answer from your live records straight away. They can do that on a simple web page, or from inside the assistant they already use.
Each person only ever sees their own records. Ask about a colleague and you get a polite refusal.
You keep control in your own records. A tick box against each person says whether they may connect, and unticking it puts them out within minutes.
The worry, and why it is the right one
The first thing most owners say is a version of the same thing. If I connect this to my systems, what stops somebody seeing something they should not?
Hold on to that instinct. It is the right question, and it is the one that separates a setup you can trust from one you cannot.
There are two ways to build this kind of access, and they differ in one respect only: who decides what a person is allowed to see.
In the weaker version, the AI decides. It can reach your records, and it has been given written instructions telling it to look only at the right ones.
In a properly built version, the AI decides nothing, and never reaches your records at all.
That sounds like a small distinction. It is the entire thing.
Why "we have told it to be careful" is not good enough
If anyone building this for you explains its safety by saying the AI has been instructed what not to look at, push back. Written instructions drift, and it takes very little to move them.
I ran a test on exactly that. The instruction asked the assistant to report attendance against the number originally booked. That number is nowhere in the data, so it refused and explained why, which was the correct answer. Softening the wording by six words was enough to change its mind. It took a figure from a completely different date and presented it as fact, without mentioning what it had done.
Same assistant, same data, nobody trying to break it. Six words between a careful refusal and a confident invention.
None of which is an argument against using AI. It is the reason a good build never asks the AI to be trustworthy in the first place.
So how does it actually work
Nobody is handed a key to the filing cabinet. Somebody inside fetches the one file and passes it out.
In practice, their assistant puts the question to a small piece of software that belongs to you. That software checks who signed in, finds that one person's record, sends back only the fields you have allowed, and re-checks their access every single time.
The assistant cannot go looking, because looking is not something it is able to do. There is nothing to talk it into, because there is nothing it can ask.
Three questions to ask whoever builds it
You do not need to know how it is put together. You do need to be able to tell whether it has been done properly.
Who decides what this person can see? The answer should be your own system, checking who signed in. If the decision sits with the AI, however carefully it has been instructed, that is the weaker version.
What happens if somebody asks the worst possible question? The right answer is that the information was never sent in the first place.
Can it change anything? At the start it should only read. Almost all of the value is in reading, and almost all of the risk is in writing.
Worth sorting before you are asked
It is one small piece of software, your existing records, and a clear decision about who should see what. That last part is yours rather than technical, and it usually takes longer than the build.
Do it now because the request is coming, and you will want an answer better than no.
If you are wondering what this would look like on your own information, that is a conversation I enjoy having.