Security hygiene: Copilot reveals your permissions.
Copilot doesn't break your security model — it OPERATES it, at full speed. Every 'everyone can technically see this' mistake that was hidden by obscurity becomes one innocent question away from surfacing. The fix is hygiene, and it's very doable.
01 The uncomfortable truth
Before Copilot, the salary sheet mistakenly shared to 'Everyone' was protected by nobody thinking to look. Now, "what do we pay project managers?" might just... answer. Copilot respects permissions perfectly — the problem is that your permissions probably don't say what you think they say. This isn't a Copilot flaw; it's a flashlight pointed at a closet everyone stopped auditing years ago.
02 The hygiene pass (small-shop edition)
Quarterly, red-team your own tenant with five questions you'd hate answered: pay, pending departures, the acquisition folder, customer lists, that legal dispute. Ask them AS a normal employee would. Every answered question is a permission fix, found for free, before someone finds it for you.
03 People rules that do half the work
Two lines for your one-page AI policy (template in our team rollout lesson — it transfers): "AI answers are permission-based, not permission-granting — finding something doesn't mean it's yours to share," and "if AI surfaces something that looks like it shouldn't be visible, report it like you'd report an unlocked door." That second one turns your whole team into the audit.
04 The payoff frame
Do the pass and Copilot becomes your permission model's ongoing auditor instead of its exploit. Skip it and you're one demo question away from an HR incident. This is the least glamorous lesson in the track and, for anyone rolling Copilot out beyond themselves, arguably the most valuable — which is exactly why it's in Pro+.
Run the tell-me test's first three questions right now. If anything answers, you know today's priority — and if nothing does, you've earned actual confidence instead of assumed confidence.
Open Copilot →This week's challenge
Complete the full hygiene pass this week: hotspot hunt, kill stray Everyone-links, label the crown jewels, audit agent reach, and add the two people-rules to your policy. Then book the quarterly tell-me test on the calendar — hygiene that isn't scheduled is hygiene that happened once.