A sales rep asks Copilot for Sales to summarize a strategic account before a renewal call. The summary omits several recent, highly relevant notes that the rep knows exist, because those notes were entered by a colleague on a different business unit's team. A consultant investigating the gap confirms the notes exist in Dataverse and are not deleted or archived. What explains the missing content in the summary?

The correct explanation is that Copilot grounds its summaries in the records the requesting user is permitted to see, so security roles and record-level sharing that block the rep's business unit from those notes will also exclude them from the summary. Copilot for Sales operates within the Dataverse security model, meaning any record it surfaces in a summary must already be visible to the signed-in user through their assigned security roles and the record's sharing or business-unit access rules. If the notes were entered by a colleague on a different business unit and were never shared with the rep's team, Dataverse itself would hide those records from the rep in a normal list view, and Copilot inherits that same restriction rather than bypassing it. The fix is to review and adjust the security roles or sharing rules if broader visibility is actually intended, not to treat this as a defect. The idea that Copilot copies referenced records into a separate cache outside Dataverse and that cache had not yet refreshed is incorrect because Copilot does not maintain a separate caching layer that lags behind Dataverse; it queries governed data directly, so a stale cache is not the mechanism at play. The claim that Copilot pulls account data from an ungoverned data store outside the Dataverse security model is incorrect because it misdescribes the architecture entirely; Copilot's grounding is built on top of Dataverse's governed data and security model rather than a separate, unsecured store. The suggestion that the summary feature has a known caching bug and the missing notes will appear automatically once the cache clears in about a day is incorrect because there is no caching defect here, and framing it as one would lead the consultant to wait for a fix that will never materialize since the exclusion is permissions working as designed.