What Copilot can't tell you

Microsoft Copilot for 365 is built on a sound principle: it respects SharePoint's granular access controls. Two employees asking the exact same question will receive different answers depending on what documents they're permitted to see. From an information security standpoint, this is correct behaviour — the alternative, an AI that leaks content across permission boundaries, would be a compliance disaster.

The trouble is more subtle, and I think more dangerous. Copilot delivers partial knowledge with full confidence.

When Copilot answers a question, it draws only from content you have access to. If the best, most complete, or most safety-critical material sits behind a permission boundary you can't cross, Copilot won't tell you. It can't. Even hinting that restricted content exists on the topic would itself be a metadata leak — a violation of the very access control model it's designed to honour.

That puts the design in an impossible position. If Copilot flags incomplete coverage, it reveals that restricted information exists. If it stays silent about gaps, users trust a partial answer as a complete one. Both paths lead somewhere bad. Microsoft chose the second.

Without Copilot, employees search SharePoint manually. They recognise the limits of what they find. They ask colleagues. They escalate. The manual process carries its own kind of honesty — you know you might have missed something. Copilot eliminates that uncertainty. It replaces "I looked around and found this" with "here's the answer." The fluency of a generated response suppresses the instinct to verify. Two people in the same meeting walk away with different AI-generated summaries, both confident, both incomplete, neither with any reason to question theirs.

Imagine two engineers at different sites asking Copilot about a commissioning procedure. One has access to the full documentation library, including safety-critical interlocking requirements. The other only has access to the general commissioning checklist. Both receive a confident, well-structured answer. Both proceed. One of them is missing safety-critical steps and has no reason to suspect it. In the kind of work I do, that is not a hypothetical risk.

Traditional access control protects against unauthorised access. What we are seeing now is something different: authorised but incomplete access being presented as complete knowledge. Enterprise risk frameworks don't yet have a clean category for it, and Microsoft's own Responsible AI documentation largely hand-waves past it with advice to "ensure good governance." It overlaps with NIS2's supply-chain duty under Article 21(2)(d) , but the duty there assesses vendors as discrete dependencies — it doesn't yet demand that their AI outputs come with confidence calibration.

A generic disclaimer on every response might help — something like "this answer is based only on content you have access to." Microsoft hasn't implemented one. A coverage indicator that warns of missing context without revealing what's missing is a harder design problem, and I see no sign of it on the roadmap.

Copilot's usefulness is hostage to the quality of an organisation's information governance. Most enterprises carry years of SharePoint sprawl — inconsistent permissions, stale sites, oversharing, broken inheritance. Copilot doesn't fix any of that. It amplifies it.

The tool respects the letter of access control whilst undermining the spirit of informed decision-making. That might be the most expensive kind of AI failure there is — not a dramatic data breach, but a slow, invisible erosion of decision quality across the whole organisation.

The question worth asking isn't whether Copilot can see your data. It's whether Copilot is honest about what it can't.