Effective access: what query-time trimming actually evaluates
When grounding runs (foundations FLOW), each candidate item is checked against the asker's effective permissions — the union of:
- Direct grants and site/library/item ACLs
- Group memberships, nested all the way down (that forgotten 'All Staff' group inside a site's members group counts)
- Sharing links whose scope includes the asker: 'People in <org>' links make content effectively org-readable — the single biggest surprise source
- Special principals: 'Everyone except external users' = the whole company
- Teams-side plumbing: standard channels ride team membership; private/shared channel content rides their own sites (the Teams curriculum's storage map decides what Copilot can reach for whom)
The rule that explains every incident: Copilot doesn't have permissions — the ASKER does. Every 'Copilot leaked X' reproduces as 'the asker opens X in the browser'. That reproduction is your incident-triage step one; it converts an AI panic into an access-review ticket.
The corners worth knowing cold
| Corner | Behaviour |
|---|---|
| Broken inheritance / item-level grants | Honoured — trimming is item-effective, which is also why nobody can reason about access by looking at site membership alone |
| Just-revoked access | Propagation lag (semantic-index concept) — briefly still retrievable |
| Encrypted (label-protected) content | Usage rights decide: no EXTRACT right = Copilot can't use the content even if the file opens |
| Guest askers | Same model, their (thin) effective graph — guests get permission-trimmed answers too |
| Agents | An agent's knowledge scope is a FURTHER restriction on top of the runtime user's access — or, for some agent auth patterns, ITS OWN identity's access (agents module: review which per agent) |
What to watch (proofs)
- The reproduction discipline: every 'Copilot showed me X' ticket gets the browser-open test FIRST — attach the screenshot; route to access review.
- The effective-access answer for one user+item: SharePoint's 'check permissions' + group-membership expansion — the manual walk that matches what trimming computed.
- Link exposure at scale: SAM's sharing-link reports (oversharing concept) — org-scope links are the graph edges people forget they created.
- The EXTRACT-right behaviour: a labeled/encrypted test doc with and without extract rights, same prompt — label enforcement demonstrated end-to-end.