Yes. A nonprofit can use an internal AI assistant to help employees find approved grant-reporting procedures, deadlines, definitions, templates and escalation contacts without giving the assistant unrestricted access to donor records, client files or confidential financial information. The system must be deliberately limited to approved knowledge sources, secured through existing Microsoft permissions and tested with realistic user accounts before employees rely on it.
Separate Reporting Guidance From Reporting Records
Grant reporting usually involves two different categories of information.
The first is operational guidance:
- Which report is required?
- When is it due?
- Which department prepares each section?
- Which template should staff use?
- Who approves the final submission?
- How should outcomes be described?
- Where should supporting documentation be stored?
The second category is transactional or sensitive data:
- Donor identities and contribution history
- Client or participant records
- Case notes
- Payroll information
- Bank records
- Personally identifiable information
- Detailed program-service data
- Information protected by contracts or confidentiality rules
An internal assistant does not need unrestricted access to the second category merely to answer questions about the reporting process.
The safer model keeps sensitive records in the nonprofit’s existing donor-management, case-management, accounting, payroll or program systems. The Knowledge Hub contains approved guidance explaining how authorized employees should use those systems.
What the AI Assistant Can Safely Explain
Suppose a human-services nonprofit receives grants from federal agencies, private foundations and local governments. Each funder has different reporting schedules and documentation requirements.
Maisy could help an authorized program manager ask:
- Which quarterly report applies to this grant?
- Who reviews the program narrative?
- Which approved outcome definitions should we use?
- Where is the current reporting template?
- When must Finance confirm the expense totals?
- Who handles questions about an unusual expenditure?
- Which system contains the supporting client records?
The answer should cite the nonprofit’s approved grant calendar, reporting procedure, responsibility matrix or funder-specific guide.
Maisy should not retrieve individual client records or decide whether a particular expenditure is allowable. Those matters remain with the designated program, Finance, grants, legal or compliance personnel.
Build an Approved Grant Knowledge Zone
The nonprofit should not connect the assistant to every grant folder. Grant directories often contain drafts, old applications, unsuccessful proposals, email exports, confidential budgets and duplicate reporting instructions.
A controlled grant knowledge zone might include:
- Approved reporting procedures
- Current funder instructions
- Reporting calendars
- Responsibility assignments
- Standard definitions
- Approved narrative examples
- Submission checklists
- Template locations
- Escalation contacts
- Records-retention guidance
Each item should identify its owner, intended audience, effective date, review date and authority level.
The AskMaisy Microsoft 365 Knowledge Hub implementation guide describes a structure using SharePoint for governed content, Microsoft Entra ID for identity, Microsoft 365 groups for access, Teams for employee access and Copilot Studio for the conversational layer.
Apply Permissions Before Connecting AI
SharePoint permissions should control access before Copilot Studio or another AI layer retrieves the content.
For example:
- All program managers may access general reporting procedures.
- Finance staff may access approved financial-reporting guidance.
- A specific grant team may access funder-specific instructions.
- Executives may access board-level and strategic grant information.
- Volunteers may receive no grant-reporting access.
- Client records remain in restricted operational systems.
Microsoft’s Copilot Studio guidance for SharePoint knowledge sources explains how authenticated agents can use SharePoint content in the signed-in user’s context. Authentication does not repair poor permissions, however. It enforces the permissions already present.
That is why the nonprofit should review group membership, inherited permissions and one-off access exceptions before launch. The article Can Microsoft Copilot See Every File an Employee Can Access? explains the related risk: AI may make existing oversharing much easier to discover.
Distinguish Approved Answers From Working Material
A grant manager’s Teams message may contain useful context, but it is not automatically an approved reporting rule. Neither is an old email, meeting note or draft narrative.
The Knowledge Hub should distinguish:
- Published knowledge: Approved procedures and instructions employees may rely on.
- Working material: Drafts, research and collaboration documents.
- Restricted information: Confidential financial, donor, client or personnel information.
- Archived knowledge: Superseded guidance retained for records but excluded from active answers.
When sources conflict, Maisy should not select whichever document appears newest or most relevant. It should identify the conflict, cite the available evidence and direct the employee to the responsible owner.
Keep the Assistant Read-Only
The safest initial design is read-only.
Maisy may explain the approved reporting process, locate the current template and identify the responsible approver. It should not submit reports, modify accounting data, alter donor records or certify compliance unless a separate workflow has been intentionally designed, approved and tested.
A Power Automate workflow could later route a completed draft for review, but that action should remain separate from general conversational retrieval.
Test More Than Easy Questions
Testing should include realistic users and failure conditions.
A useful test set includes:
- A program manager asking for an approved template
- A Finance employee asking about review responsibilities
- A volunteer attempting to obtain grant information
- A staff member requesting individual client data
- A user asking about an expired grant
- Two documents containing conflicting deadlines
- A citation that points to a restricted location
- A question not covered by approved sources
The answer and every citation should be tested together. A harmless summary can still create a security problem if its source link exposes a restricted library.
The NIST AI Risk Management Framework encourages organizations to incorporate trustworthiness and risk management throughout AI design, deployment and evaluation rather than treating risk as a final technical check.
Where Pixeldust and Maisy Fit
Pixeldust is the consulting and implementation company. Its process—Understand, Organize, Empower—begins by learning how the nonprofit currently manages grants, systems, responsibilities and sensitive information.
Pixeldust then helps establish the Knowledge Hub: the governed collection of approved reporting knowledge, ownership rules, permissions and review processes.
Maisy is the employee-facing conversational assistant. It helps authorized staff retrieve trusted guidance from that Knowledge Hub.
Maisy does not replace the grants manager, Finance team, program leadership, legal counsel, funder guidance or the nonprofit’s operational systems. It helps employees find the approved information needed to involve those people and systems correctly.
The proper objective is not to let AI see everything. It is to give each authorized employee the most useful answer that can be constructed entirely from information that employee is allowed to use.
