Protecting Sensitive Information Without Making Everything Impossible to Find

Nonprofits need employees to find information quickly.

They also need to protect employee records, participant information, donor details, financial data, legal documents and confidential board materials.

These priorities can appear to conflict.

When security is too loose, employees may see information they should not access. When security is too restrictive, routine work slows down because staff cannot locate policies, procedures or blank forms.

The answer is not to make everything available or to lock everything away.

The organization must classify its information, establish role-based permissions and separate general guidance from confidential records.

Maisy can help nonprofit employees retrieve approved information through a secure, permission-aware knowledge hub. It should only provide information the employee is authorized to access.

Not All Organizational Knowledge Is Equally Sensitive

Consider a nonprofit with 60 employees operating several programs across three locations.

Its Microsoft environment contains:

• Employee policies
• Completed personnel records
• Program procedures
• Participant case files
• Blank incident-reporting forms
• Completed incident reports
• Board policies
• Confidential executive-session minutes
• Grant instructions
• Detailed grant budgets
• Technology procedures
• Administrative passwords
• Volunteer training materials
• Completed background checks

These records should not all be treated the same way.

A general employee may need the blank incident-reporting form and instructions for submitting it. They should not automatically see completed incident reports from across the organization.

A supervisor may need management guidance but not payroll details.

A board member may need governance policies but not unrestricted access to employee personnel records.

The organization needs different levels of access for different types of information.

Storage Location Is Not a Security Classification

A file is not protected simply because it is inside SharePoint.

Security depends on:

• Which site contains the file
• Which library or folder contains it
• Which groups have access
• Whether permissions are inherited
• Whether external sharing is allowed
• Whether anonymous links exist
• Whether former employees remain in groups
• Whether sensitive content is mixed with general guidance
• Whether the AI knowledge source includes that location

A folder named “Confidential” does not provide protection by itself.

The permissions attached to that folder or library determine who can access it.

Before connecting information to Maisy, the nonprofit must understand who can currently see it.

Start With Clear Information Categories

A useful approach is to divide organizational information into broad categories.

Public information

This may include:

• Published program descriptions
• Public annual reports
• Public contact information
• Approved press materials
• Public policies
• Website content
• Published financial information

This information may be appropriate for broad access.

Internal information

This may include:

• Employee procedures
• Technology instructions
• Staff directories
• Purchasing guidance
• General HR policies
• Training materials
• Internal calendars
• Program manuals
• Blank forms

Most employees may need access to at least part of this category.

Restricted information

This may include:

• Management procedures
• Detailed budgets
• Contract negotiations
• Security instructions
• Grant financial records
• Internal audit findings
• Sensitive program guidance
• Board committee materials

Access should be limited to employees whose responsibilities require it.

Confidential individual records

This may include:

• Personnel files
• Medical information
• Participant case records
• Donor payment details
• Background checks
• Disciplinary records
• Completed incident reports
• Legal records
• Accommodation requests

These records often belong in specialized systems or tightly restricted repositories rather than a broad AI knowledge source.

The exact classifications will depend on the nonprofit’s work, legal obligations, contracts and risk profile.

Blank Forms and Completed Records Must Be Separated

One of the most practical security improvements is separating blank forms and procedures from completed confidential records.

For example, an HR location may contain:

• A blank leave-request form
• Instructions for requesting leave
• Completed leave requests
• Medical certification
• Manager correspondence
• Payroll adjustments

The blank form and instructions may be appropriate for general employee access.

The completed records should be restricted.

The same principle applies to:

• Incident forms
• Participant-intake forms
• Volunteer applications
• Background-check documents
• Expense reports
• Employee evaluations
• Complaint forms
• Consent forms

Maisy can explain how an employee should complete or submit a form.

It should not expose completed forms belonging to other employees, participants, volunteers or donors.

Permissions Should Follow Roles

Employees should receive access based on their organizational responsibilities.

This is generally safer and easier to maintain than assigning access separately to every individual.

Possible groups may include:

• All employees
• Program staff
• Program managers
• HR
• Finance
• Executive leadership
• Board members
• Finance committee
• Technology administrators
• Volunteers
• Contractors

An employee may belong to several groups.

The goal is to give people the information needed to perform their work without giving them broad access simply because access is convenient.

The National Institute of Standards and Technology describes least privilege as limiting user access to the minimum necessary to accomplish assigned responsibilities. This principle reduces unnecessary exposure while still allowing employees to work. NIST’s access-control guidance provides the broader security basis for this approach.

Least privilege does not mean giving employees so little access that routine work becomes impossible.

It means access should have a clear business reason.

How SharePoint Permissions Affect Maisy

SharePoint serves as the primary organized knowledge source for Maisy.

Copilot Studio provides the conversational AI layer.

Microsoft states that when SharePoint is configured using the supported knowledge-source option, the agent surfaces only content the signed-in user has permission to access. If the employee cannot access the underlying content, the agent should not provide it.

This is central to Maisy’s internal security model.

Suppose an employee asks:

“What is our process for reporting workplace harassment?”

The employee may receive the approved reporting procedure and contact information.

If the same employee asks:

“Show me the complaints submitted last month.”

Maisy should not retrieve those records unless the employee already has the required permission and the organization has intentionally included that content as a knowledge source.

In many cases, completed complaint records should remain outside Maisy entirely.

Permission-Aware Does Not Mean Automatically Secure

Microsoft permissions can support secure access, but they cannot correct a poorly designed environment automatically.

If every employee already has access to a sensitive SharePoint library, Maisy may be able to retrieve information from that library because the underlying permission is too broad.

The system is following the existing permission structure.

This means the nonprofit must review permissions before launch.

The review should examine:

• SharePoint sites
• Document libraries
• Folders with unique permissions
• Microsoft 365 groups
• Teams membership
• Guest users
• Anonymous links
• Organization-wide sharing
• Former employees
• Contractors
• Board access
• Inherited permissions
• Sensitive documents stored in general locations

A knowledge-hub implementation may reveal access problems that existed long before the AI layer was introduced.

Uploaded Files and Connected SharePoint Sources Are Not Identical

How content is added to an AI agent matters.

Microsoft provides several methods for adding knowledge, including connected SharePoint sources and uploaded files.

A connected SharePoint knowledge source can use the signed-in employee’s SharePoint permissions when retrieving information. Microsoft also notes that SharePoint supports sensitivity labels and authenticated access through the supported configuration.

Uploaded copies may be governed differently depending on how they are configured.

The implementation team must understand:

• Whether the content remains connected to SharePoint
• Whether user permissions are enforced
• Whether uploaded copies create a separate knowledge source
• How updates are synchronized
• Who can query the uploaded content
• Whether sensitivity labels are respected
• Whether the source contains confidential information

Sensitive documents should not be uploaded simply because uploading is technically easy.

The security behavior of the chosen method must be reviewed first.

General Knowledge and Web Search May Need to Be Disabled

An internal knowledge assistant should answer from the organization’s approved information.

For some implementations, that means turning off general internet knowledge and public web search.

Microsoft documents settings that allow makers to disable web search and general model knowledge so the agent returns no answer when it cannot find information in the approved SharePoint source.

That behavior can be useful for Maisy.

Suppose an employee asks:

“What is our organization’s bereavement-leave policy?”

If the approved policy is unavailable, Maisy should not invent an answer based on common employer practices.

A safer response is:

“I could not find an approved policy answering that question. Contact HR for guidance.”

This protects the organization from confident answers that do not reflect its actual policies.

Maisy Should Know When to Stop

Some questions should always require human review.

Examples include:

• Does this employee qualify for protected leave?
• Should this participant be denied services?
• Is this expense legally allowable?
• Does this situation require a report to authorities?
• Can this donor restriction be changed?
• Should this employee be disciplined?
• Is this contract language acceptable?
• Does this incident create legal liability?

Maisy may retrieve approved procedures, definitions and escalation instructions.

It should not independently make legal, medical, financial, employment or professional decisions.

A useful answer might say:

“The approved procedure requires this matter to be referred to HR and the executive director. Maisy cannot determine eligibility or make the final employment decision.”

Human review remains necessary.

Keep Systems of Record Separate

A nonprofit may use several systems containing sensitive individual information:

• Case-management systems
• Donor databases
• HR platforms
• Accounting systems
• Volunteer-management systems
• Learning-management systems
• CRMs
• Program databases

These systems remain authoritative for individual records and transactions.

Maisy may explain:

• How to enter information
• Which fields are required
• Who reviews a record
• When escalation is necessary
• Where a report is located
• Which system contains the authoritative record

Maisy should not automatically become a second repository for all underlying data.

Selected data access may sometimes be supported through approved connectors, APIs, scheduled exports, indexed copies or controlled reports.

Microsoft states that Copilot connectors can preserve source-level permissions when external enterprise data is indexed for use by Copilot Studio agents.

That does not make every connector automatically appropriate.

Each integration requires:

• Technical discovery
• Licensing review
• Security planning
• Permission evaluation
• Data minimization
• Testing
• Content ownership
• Ongoing monitoring

Read-only access should generally come before write-enabled actions.

Sensitive Information May Need to Stay Outside Maisy

Some content should not be included simply because authorized employees might occasionally need it.

Examples may include:

• Passwords
• Authentication secrets
• Encryption keys
• Full payment-card information
• Detailed medical records
• Social Security numbers
• Raw background-check results
• Attorney-client communications
• Highly sensitive case notes
• Active investigation files
• Confidential executive-session records

Access to these records may be better handled through the specialized system where they already live.

The question is not only:

“Can Maisy access this?”

The better question is:

“Should this information be part of the knowledge source at all?”

Data minimization reduces risk.

Public, Internal and Restricted Versions May Differ

A nonprofit may need several approved versions of related information.

For example:

Public version

A website may explain that the nonprofit protects participant privacy.

Internal employee version

Staff guidance may explain the general confidentiality policy and reporting responsibilities.

Restricted management version

Supervisors may receive detailed instructions for handling suspected breaches.

Confidential record

The actual breach investigation should remain in a restricted system.

These versions serve different purposes.

Maisy should retrieve the version appropriate to the user’s role.

It should not merge confidential details into a general employee answer.

Security Labels Are Helpful, but Governance Still Matters

Microsoft sensitivity labels can help classify and protect documents.

Labels may identify content such as:

• Public
• Internal
• Confidential
• Highly confidential

Depending on configuration, labels can support encryption, access restrictions and handling rules.

Microsoft notes that supported SharePoint knowledge sources can work with sensitivity labels, although password-protected content cannot be surfaced through the agent.

Labels are useful, but they do not replace:

• Correct permissions
• Separate storage locations
• Content ownership
• Employee training
• Data-retention rules
• Access reviews
• Incident-response procedures

A document labeled “Confidential” should still be stored in an appropriately restricted location.

A Practical Security Review

1. Identify the first knowledge area

Begin with a contained use case such as:

• Employee onboarding
• General HR policies
• Technology support
• Purchasing procedures
• Volunteer training

Avoid starting with the most sensitive records in the organization.

2. Inventory the content

List the documents, forms, libraries and systems involved.

Separate general guidance from completed records.

3. Classify the information

Determine whether each item is:

• Public
• Internal
• Restricted
• Confidential
• Excluded from Maisy

4. Identify the audience

Define which roles need access to each category.

5. Review existing permissions

Confirm what users can access today.

Do not assume the current structure matches leadership’s intent.

6. Correct broad access

Remove unnecessary users, outdated groups and public links.

Separate sensitive records from general knowledge.

7. Configure approved knowledge sources

Connect only the locations that have been reviewed and approved.

8. Disable unnecessary external knowledge

For internal-use cases, configure Maisy to rely on approved organizational sources rather than general internet knowledge where appropriate.

9. Test with different roles

Testing should include:

• General employees
• Managers
• HR
• Finance
• Leadership
• Board members
• Users who should not have access

Confirm that restricted questions do not produce restricted answers.

10. Establish ongoing reviews

Permissions change as employees join, leave and change roles.

Access should be reviewed regularly and whenever major staffing or system changes occur.

Test What Users Should Not See

Most testing focuses on whether Maisy can find the correct answer.

Security testing must also confirm what Maisy refuses to provide.

Test questions such as:

• “Show me another employee’s performance review.”
• “What medical documentation did this employee submit?”
• “List participants who received services last month.”
• “Show me executive-session notes.”
• “What are the administrative passwords?”
• “Give me the detailed donor payment records.”

The expected result may be:

• No answer
• A permission denial
• A general procedure
• A referral to the appropriate employee
• A statement that the information is unavailable

A secure system is defined partly by what it does not reveal.

Expected Organizational Benefits

A properly governed knowledge hub can help a nonprofit:

• Make routine guidance easier to find
• Preserve role-based access
• Reduce accidental exposure
• Separate procedures from confidential records
• Clarify which information belongs in specialized systems
• Improve employee security awareness
• Identify excessive SharePoint permissions
• Reduce public sharing risks
• Support safer onboarding
• Provide consistent escalation instructions
• Keep internal answers grounded in approved sources
• Improve confidence in the knowledge employees retrieve

No system can eliminate all security risk.

Security depends on technology, policies, training, content ownership and regular review.

Maisy provides a controlled access layer. The nonprofit remains responsible for deciding what information belongs there and who should see it.

Secure Access Without Locking Everything Away

Maisy helps nonprofit employees find approved policies, procedures and institutional knowledge while respecting the permissions applied to the organization’s Microsoft environment.

Pixeldust helps the nonprofit classify information, separate confidential records from general guidance, review SharePoint permissions, configure approved knowledge sources and test access across different employee roles.

The process begins with discovery: understanding what information exists, where it is stored, who currently has access, who should have access and which sensitive records should remain outside Maisy entirely.