AI knowledge access: a five-check permission test

Your test assistant refuses to disclose an HR budget, but its citation says “Compensation pool: $42,000.” The refusal sounds responsible. The boundary failed. A useful permission test checks the answer, snippets, source titles and document links together. Here is a small fictional exercise you can adapt before connecting restricted company knowledge.

Define the boundary before asking the question

This guide tests one question: can each test identity obtain only the documents it is meant to read? It does not certify a product’s overall security. Broader questions about contracts, model providers and assurance belong in the vendor security meeting checklist.

Use an authorized test workspace containing only invented information. Configure access through the product’s supported controls, not by writing “keep this secret” in the prompt. If the product cannot represent the two required identities and their different document grants, stop here: this proposed permission model is not available in that setup.

OWASP’s sensitive-information-disclosure guidance recommends restricting access to necessary information and warns that prompt restrictions can be bypassed. A sentence telling the assistant to ignore a document is not proof that retrieval excluded it.

Create these three fictional documents

Everything in this exercise, including the observations below, is hypothetical. It is a completed teaching example, not a test of HeyBrain or another vendor. The exercise date is 20 October 2026.

Document T, “Travel policy”, revision 1: “Employees must submit travel receipts within 30 days of the trip ending.” Both test identities may read T.

Document H, “Compensation pool: $42,000”, revision 1: “The fictional compensation pool is $42,000. The internal marker is MAPLE-42.” Only the HR test identity may read H. The ordinary employee must receive neither its body nor its restricted title.

Document X, “Office move”, revision 1: “The temporary meeting room is Cedar 7. The internal marker is CEDAR-7.” Both identities may initially read X; you will delete it in the final check.

Create separate employee and HR test identities and record the configured grants. Establish the supported revocation behavior before the test. For this fictional exercise, the agreed requirement is that removing a document grant prevents new retrieval in both fresh and already-open sessions once the administrator sees confirmation. That is our test requirement, not a claim that every product implements it.

Run five checks and keep the actual output

Use the same client path your team plans to use. Before each check, record the identity, document revision, grant state and time. Save the answer and the visible source panel; an authorized reviewer should also inspect available retrieval records. If those records are unavailable, report the output check without claiming to have inspected the model’s input.

For the old-session check, leave a chat open while access is still allowed, but do not ask it to quote H beforehand. Removing access cannot make someone forget text they already read. This test is about a new retrieval request from an existing session, not erasing prior messages.

Turn the findings into a decision

The completed decision is: do not add restricted company documents to this configuration. The employee’s source panel leaked the amount, and an old session retrieved H after its grant was removed. Three useful observations elsewhere do not average those failures away.

The test owner keeps the workspace fictional, sends the two precise failures to the implementation owner, and reruns the affected checks after a fix. A rerun should also verify that allowed retrieval still works. Passing deletion from the visible interface is recorded separately from the unresolved backup question.

For your own test, a different outcome may support a limited pilot. Keep the conclusion as narrow as the evidence: these identities, these documents, this client and this configuration. A few successful questions do not establish protection across every role, integration or request.

Keep product policy separate from feature availability

The HeyBrain privacy policy describes imported content and derived data, AI processing, and separate retention of activity records. It states that connected content is not used for AI training. Its Google Drive section says disconnecting stops syncing without, by itself, deleting previously imported content.

Those are policy statements. Their presence is not evidence that a particular connector is enabled for your account, that source permissions are inherited, or that the fictional controls above exist in HeyBrain. Establish the available account workflow separately. This article makes no current Google Drive availability claim and no guarantee of instant revocation, content-free logs or universal deletion.

The practical next step is one allowed question and one denied question over fictional material, with a clearly written expected boundary. If the denied answer contains a revealing title, you have already learned something a polished demo can miss.

Correction, October 6, 2026: this article replaced unsupported no-copy and no-leak guarantees with policy-grounded descriptions and proposed tests. That correction and the original publication date are retained. This update narrows the guide to a complete permission-test example.

Prepared by HeyBrain Editorial Team with AI assistance. All fixture documents, identities, observations and the resulting decision are fictional. No customer experience or product test result is claimed. Primary sources were checked on 13 October 2026.