How do you keep AI out of systems it should not touch?

The instinct is to write a rule: do not access the payroll folder, do not read the legal correspondence, do not touch the production database. Rules of this kind work most of the time and fail in the situation where they matter — an unusual request, a plausible reason, a path that was not anticipated in the wording. A boundary that depends on interpretation is not a boundary, it is a preference with good intentions.

So the first control is connection. What is not connected cannot be read, and no instruction is required. This sounds trivial and it is regularly violated in practice, because connections are granted broadly at setup time for convenience and never narrowed. Auditing what each tool can currently reach, once, usually produces a surprise and a short list of things to disconnect.

The second is scope within a connection, which matters because most integrations grant more than the job needs. A mailbox connection reaching one label rather than everything. A drive connection reaching one folder. A database connection using an account with access to specific tables. These are configured at authorisation and are much harder to add afterwards, so the effort belongs at setup.

The third is separation of the material itself. Where sensitive content sits in the same location as the material a system needs, no permission scheme can separate them, and the practical fix is to move the sensitive content somewhere the connection does not reach. This is ordinary information housekeeping and it is more effective than any access rule, because it removes the possibility rather than governing it.

The fourth applies to local machines and is the one most often overlooked. An assistant running on a laptop can generally read everything that user can read — the home directory, the credential files, the browser data, the mounted shares — and none of that was granted deliberately. Running the work in a dedicated directory, under a dedicated account, is what turns an unbounded reach into a stated one.

There is a residual case worth naming: material that arrives into a permitted location. A sensitive document dropped into the folder the system reads is now reachable regardless of every decision above. This is a process problem rather than a technical one, and the honest mitigation is to tell people which locations are connected, which is a sentence most businesses have never said out loud.