Can AI connected to Innguma see all the information?

What does a connected assistant see depends on what?

On three layers, each with its own owner:

1. The MCP server decides which tools and data it exposes. The specification allows the set of tools to vary according to the authorisation with which each client connects^[1]. In Innguma, this layer is the scope of each integration.
2. The organisation decides which capabilities it enables: query only, or also management of sources, filters and publication.
3. The assistant decides how it uses what it receives, how it asks for confirmations, and which data conditions apply under the plan contracted.

None of the three layers replaces the others. The protocol on its own does not guarantee data privacy: the specification acknowledges that it cannot impose its security principles and that this is the responsibility of whoever implements it^[2].

What risks appear when an assistant is given access?

• Prompt injection. It is the first risk in the OWASP Top 10 for applications built on language models: external text, such as a captured news item, may contain hidden instructions that the model tries to follow^[3]. Anthropic warns of the same for malicious MCP servers^[4].
• Excessive agency. OWASP attributes it to functions, permissions or autonomy greater than necessary, and recommends least privilege^[5].
• Mass processing. The AEPD warns that uncontrolled access by an agent to internal data can lead to processing that breaches the principle of data minimisation, and that tool calls may extract data without the user noticing^[6].
• Shared credentials. If a connector uses a single credential for everyone, everyone accesses with it. Anthropic recommends limiting that credential to what members should see^[4].

What does the MCP specification say about authorisation?

Authorisation is optional in MCP. When it is implemented over HTTP, it is based on OAuth 2.1, and the specification asks clients to request only the permissions needed for each operation, following the principle of least privilege^[7]. Its best-practice guide advises against wildcard permissions and proposes starting with a minimal read-only set, extending it when an operation requires it^[8]. These are recommendations of the standard: how they are applied depends on each implementation and each assistant.

How does this apply at Innguma?

Innguma defines which knowledge and which capabilities it makes available to each integration with ChatGPT, Claude, Microsoft Copilot or Gemini, and your organisation decides which ones it enables. Write capabilities, such as publishing, editing or deleting content, or modifying filters, are only available if your organisation enables them. What is automated, and what goes through human review first, is decided by your team.

Individual access to the platform is a separate layer: Innguma integrates with the client’s Active Directory for corporate sign-in and for centralised additions and removals.

What should you decide before connecting an assistant?

1. What the use case needs, and what does not need to be exposed.
2. Which capabilities are enabled at the start: beginning with querying and extending later reduces the risk.
3. Which assistant the internal AI policy authorises, and on which plan.
4. Who authorises the connection, and who reviews what the assistant produces before it is shared.
5. Which information, given its sensitivity, should be handled outside the assistant.