AI Security, Access, and Data Boundaries

AI security, access, and data boundaries must be enforced independently of the AI model.

Authorization first

Determine what the current user is allowed to access before content is supplied to an AI workflow.

Tenant isolation

Tenant-specific data must remain within the resolved tenant context.

AI must never combine private information from separate tenants.

Public versus internal knowledge

Public Product Help content can support public documentation scenarios.

Internal, authenticated, or restricted content requires the applicable authorization.

Sensitive information

Do not expose passwords, API keys, encryption material, private customer data, or other protected information to an AI workflow unless explicitly authorized and necessary.

Logging

AI-related logging should avoid storing unnecessary sensitive input or credentials.

Good practices

Design AI features as consumers of existing security decisions, not as an alternative authorization layer.