Municipal HR/payroll tests whether a clerk without access to a restricted benefits library still sees those files in Copilot. What result should they expect?

If a municipal HR/payroll clerk lacks access to a restricted benefits library, Copilot should not surface those library files for that clerk because Copilot respects the user's existing Microsoft 365 access. That is the expected test result when validating permission boundaries. The library lacking an approved sensitivity label is not why the clerk would not receive those files; Copilot withholds them because the clerk lacks access, and the presence or absence of a label does not grant library permissions. The site being excluded from semantic index grounding is not why the clerk would not receive those files; semantic indexing only surfaces content the user is already allowed to see, so even if the site were indexed the clerk without library access still would not receive those files. Restricted libraries being excluded by retention policy is not why the clerk would not receive those files; retention governs how long content is kept, not who may see it in Copilot, so the block is due to the clerk's missing library access. Exam caveat: the concept is central to Copilot data-security fundamentals—no access means Copilot should not return those files for that identity. Operational check: sign in as a clerk without library rights, attempt Copilot prompts about sealed benefits content, confirm no sealed files appear, and document the control as part of HR/payroll AI readiness. Treat the HR/payroll Copilot test as a positive control validation: absence of sealed benefits content for the unauthorized clerk is the success criterion, not a product defect. If sealed files appear, investigate oversharing, incorrect group membership, or broken inheritance before blaming Copilot. Document the test identity, library path, and result so auditors can see that permission boundaries were verified for AI use.