The tenant is the first boundary
AI Link scopes users, resources and actions to an organisation. User-facing requests derive the organisation from the authenticated session. Entering an organisation identifier must not grant additional access.
Within an organisation, personal spaces and team knowledge have different visibility. A search index must apply these rules when retrieving information. Hiding a confidential file from the ordinary file list is not enough.
Agents need a task and boundaries
An agent's permitted tools are part of its configuration. Reading, drafting and making changes have different consequences. External actions should have approval controls and clear ownership.
An email may contain an instruction, but it is not authorisation. Prompt-injection attacks exploit exactly this confusion. Tool permissions and server-side controls must constrain what an agent can do.
A useful permission test
Testing with separate accounts makes access boundaries verifiable: a file shared only with account A must not appear in account B’s results, summaries or citations. Repeating the comparison after access is revoked shows whether changes take effect.
Sources & further reading
Original research, provider documentation and further reading on the concepts and figures discussed here.