Can Board Members and Volunteers Use the Same Nonprofit AI Assistant Without Seeing Staff-Only Information?

Yes. Board members, employees and volunteers can use the same employee-facing AI assistant only when their identities, group memberships, connected knowledge sources and SharePoint permissions are designed to produce different access for each audience. A shared conversational interface does not require shared access to every document, but the nonprofit must test each role rather than assume the permissions work.

One Assistant Does Not Mean One Access Level

A nonprofit may want everyone to use Maisy through Microsoft Teams or another approved interface. That does not mean every user should receive the same answer.

Consider a regional animal-welfare nonprofit:

• Volunteers need animal-handling instructions, shift procedures and emergency contacts.
• Employees need operational procedures, internal schedules and HR policies.
• Managers need escalation guidance and management procedures.
• Board members need governance policies, committee materials and approved strategic information.
• Finance staff need restricted financial procedures.
• HR staff need confidential personnel guidance.

The conversational experience may look similar for every user. The underlying retrieval boundaries should not.

Start With User Populations

Permission design should begin with identifiable groups, not individual document exceptions.

Typical groups might include:

• All employees
• Program employees
• Managers
• Volunteers
• Board members
• Finance
• HR
• Executives
• Contractors
• Temporary project teams

Each group should receive access only to the knowledge required for its responsibilities.

A volunteer should not gain access to employee-relations procedures simply because both volunteer and staff materials are stored on the same SharePoint site. A board member should not automatically receive personnel records merely because the board provides organizational oversight.

The nonprofit should use Microsoft 365 or Entra ID groups whenever practical rather than granting permissions person by person. Group-based access is easier to review, test and remove when someone’s role changes.

Organize Knowledge Around Security Boundaries

Permissions become difficult to maintain when unrelated audiences share one large document library.

A better structure separates knowledge into controlled zones, such as:

• General organizational knowledge
• Employee procedures
• Volunteer guidance
• Board governance
• Program-specific knowledge
• Management guidance
• HR-restricted knowledge
• Finance-restricted knowledge
• Archived or superseded information

The Pixeldust implementation process begins by understanding how the organization operates, identifying the information each role needs and organizing approved content before configuring the conversational assistant.

This is more reliable than connecting Maisy to a general nonprofit file repository and attempting to control sensitive answers through instructions alone.

Permissions Must Exist at the Source

Prompt instructions are not a security boundary.

Telling an assistant, “Do not show HR information to volunteers,” is useful behavioral guidance, but the volunteer should also lack permission to retrieve the HR source.

Microsoft’s Copilot Studio SharePoint knowledge guidance explains that authenticated retrieval can surface content based on the individual user’s access. The correct sequence is:

1. User identity
2. Group membership
3. SharePoint permission
4. Approved knowledge source
5. Conversational answer

The AI layer should not create a second, disconnected permission system.

Board Access Requires Deliberate Design

Board members create a special challenge because their information needs vary by organization.

A board member may appropriately need:

• Bylaws
• Board policies
• Committee charters
• Meeting schedules
• Approved minutes
• Strategic plans
• Executive dashboards
• Conflict-of-interest procedures

That does not necessarily mean the board member should retrieve:

• Employee case files
• Investigation notes
• Payroll details
• Unapproved executive drafts
• Client or participant records
• Credentials or security information
• Attorney-client privileged communications

Highly sensitive board information may also require a separate SharePoint site or restricted library instead of being mixed with ordinary governance material.

The content owner should determine what is appropriate for board use. The Microsoft 365 administrator implements the access. Those are different responsibilities.

Volunteer Access Should Remain Narrow

Volunteers usually need enough knowledge to perform an assigned role safely and consistently.

Maisy might answer:

• Where do I check in?
• Which safety procedure applies?
• What should I do after an incident?
• Who approves a schedule change?
• Which form should I use?
• When must I contact an employee?

Maisy should not expose confidential client information, internal personnel matters or management discussions.

Microsoft’s Copilot Studio authentication guidance should be reviewed before promising a single deployment model to employees, guests, volunteers and board members. Guest-user behavior, licensing and channel support can differ from standard employee access.

Exclude Drafts and Superseded Material

Correct permissions do not guarantee correct answers.

A board member may have legitimate access to a folder containing both approved bylaws and a proposed revision. A volunteer library may contain last year’s safety procedure beside the current one.

The Knowledge Hub should clearly identify:

• Approved content
• Draft content
• Superseded content
• Archived records
• Restricted content
• The accountable owner
• Effective and review dates
• The intended audience

When two approved-looking documents conflict, Maisy should not quietly merge them. The AskMaisy article What Should an Internal AI Assistant Do When Two Company Policies Conflict? explains that the assistant should expose the contradiction, cite the evidence and escalate the issue to the responsible owner.

Test With Real Accounts

Administrator testing is insufficient because administrators frequently have broader access than ordinary users.

The nonprofit should test with representative accounts for:

• A standard employee
• A program manager
• A volunteer
• A board member
• An HR employee
• A Finance employee
• A user with minimal access
• A former or transferred user whose access should have changed

Tests should include direct and indirect questions. A volunteer may ask for an HR document directly, but may also ask the assistant to summarize “all known reasons an employee left.” Both access paths matter.

Citations must also be opened using each test account. The text of an answer may be appropriate while the linked source reveals a restricted library name or location.

The NIST AI Risk Management Framework Playbook organizes suggested risk-management activities around governing, mapping, measuring and managing AI risks. That model supports ongoing permission reviews and realistic testing rather than a one-time launch approval.

Where Pixeldust and Maisy Fit

Pixeldust is the consulting and implementation company. It helps the nonprofit understand its user populations, organize approved content, establish ownership, configure Microsoft permissions and test the resulting system.

The Knowledge Hub is the governed collection of approved information, access rules and maintenance responsibilities.

Maisy is the employee-facing conversational assistant that helps each authorized user retrieve trusted answers from the information available to that person.

Maisy does not replace the board, managers, volunteer coordinators, HR personnel or professional judgment. It should provide read-only guidance unless a separate approved workflow is intentionally designed.

A secure shared assistant should not answer every user identically. It should answer each user from the appropriate approved evidence—and say when information is restricted, missing, conflicting or outside its authority.