A municipal HR liaison opens only role-appropriate files so Copilot cannot surface another employee’s disciplinary memo. What mitigation does this illustrate?

Access discipline so Copilot only works with content the user is entitled to see is the mitigation illustrated when a municipal HR liaison opens only role-appropriate files. Copilot grounds on what the signed-in user can already access; keeping disciplinary memos out of the open set and out of over-permissioned libraries prevents Copilot from surfacing another employee’s sensitive personnel content into the liaison’s chat. The correct approach works because generative assistants inherit the user’s permission boundary rather than granting a backdoor around HR confidentiality.

Granting every clerk full HR library access fails because completeness of answers is not worth collapsing least privilege; broader access increases the chance Copilot will retrieve or summarize disciplinary material for people who should never see it. Turning off all permissions so Copilot invents disciplinary outcomes fails conceptually: inventing outcomes is fabrication, and removing permissions does not create a safe substitute for authoritative HR records. Pasting sealed personnel files into public Copilot Pages fails because Pages collaboration widens visibility; sealed HR content does not become appropriate grounding simply because a generative draft is convenient.

Exam caveat: access discipline is necessary but not sufficient—users can still paste text they should not, so minimization and DLP remain complementary controls. Operational check: verify the HR liaison’s SharePoint or OneDrive permissions exclude sealed disciplinary libraries, open only the role-appropriate files needed for the task, and confirm Copilot’s grounded citations never reference another employee’s personnel memo.