How can we help?

AI Employees are designed to perform tasks using the information, instructions, and capabilities associated with their authorized business environment. An AI Employee should not gain access to another organization's private information simply because a user asks it to do so. AI capabilities must operate within the relevant authorization boundaries. What information can an AI Employee use? Depending on its configuration, an AI Employee may use: 1. Assigned instructions. 2. Relevant business knowledge. 3. Authorized conversation context. 4. Business process information. 5. Permitted integration data. 6. Relevant persistent memory. 7. Outputs from authorized collaboration activities. The information available depends on the actual feature configuration and access controls. Can a user ask an AI Employee to retrieve another company's customer list? A natural-language request does not establish authorization. An AI Employee should not retrieve information from an unrelated business environment merely because the request describes that information. Can AI Employees access one another's information? AI collaboration may allow participating AI Employees to exchange task-related information. The exchange must remain within the relevant business and authorization boundaries. Collaboration is not permission to access unrelated customers' data. What about customer-facing AI Employees? Customer-facing AI Employees may interact with external users. They should be configured to access only the knowledge and operations appropriate to their customer-facing responsibilities. Internal business information should not be exposed simply because a customer asks for it. Can prompt injection affect data isolation? Prompt injection occurs when untrusted text attempts to manipulate an AI system into ignoring instructions or performing unauthorized actions. Organizations should not rely exclusively on natural-language instructions to protect sensitive resources. Effective protection also depends on technical authorization checks and appropriate restrictions on tools and data access. What if an AI Employee generates information that appears to belong to another business? Do not assume the output represents an actual data disclosure without investigation. AI systems can produce inaccurate or fabricated information. However, any credible indication of unauthorized access should be reported promptly. How can organizations reduce risk? 1. Define AI Employee responsibilities clearly. 2. Review connected knowledge resources. 3. Limit integration permissions. 4. Separate internal and customer-facing responsibilities. 5. Test representative access scenarios. 6. Review unexpected outputs. 7. Require human oversight for sensitive operations. Summary AI Employees should operate as authorized participants in a business environment, not as unrestricted gateways to platform-wide information.