How much system access should an AI tool receive?
Give an AI tool the narrowest access that lets it do one described task. Start with the information that task needs, and keep reading apart from editing and preparing apart from sending. A tool that summarizes one document doesn't need the whole department's files.
The summit's trust discussion treated AI as an organizational issue. One practical result is that you describe the work before you decide what the tool can reach.
Work with the system owner to set the narrowest permissions that still work. Look at inherited access and connected services as well as the first screen where the tool is installed. Write down who can change those settings.
Then test it. Try ordinary requests and some that fall outside the task, so your team knows what happens when the tool meets information it shouldn't use. Review access when the assignment grows, when someone changes roles or when the tool is retired. Permission should follow the current job.
This is a proposed operating practice. It makes no claim that any product makes access risk disappear.
What to try this week
Think of one task your team gives an AI tool and list the information it needs. Mark what it can read, what it can edit and what it can send. Ask the system owner to set the narrowest permissions that fit, then try a request outside the task.