“Limit access to sensitive data based on the principle of least privilege. Only grant access to data that is necessary for the specific user or process.”

“Limit model access to external data sources, and ensure runtime data orchestration is securely managed to avoid unintended data leakage.”

The Slack AI exfiltration (Slide 15) worked specifically because the AI's retrieval scope crossed a boundary it shouldn't have — pulling from public channels regardless of which channel the asking user actually had access to. Tighter source restriction at the retrieval layer would have closed this.

→ Scope every data connection an LLM has to the minimum needed for its task — the same principle IAM teams apply to service accounts, applied to AI tooling
→ Never let a single retrieval query span every data source the AI is connected to; scope by the requesting user's actual permissions
→ Audit runtime data orchestration the same way you'd audit a service account's API scopes

Ask: if this AI integration's access token were stolen, what's the blast radius? If the answer is “everything the company has,” access controls aren't enforced — they're aspirational.