Grant named folders, read-only, to the agent's own identity, never a team group or a person's account. Add write access only to one designated output folder. The agent may not change permissions, create sharing links or delete files, and sensitive areas such as HR, legal and board folders are excluded. Every file it opens is logged against its identity.
Why are shared drives a particular risk?
Shared drives grow without design. Permissions are inherited from parent folders, granted to broad groups, and widened by sharing links that nobody remembers creating. A person with access to a team drive rarely opens most of what they could. An agent can open all of it in minutes, and will, if its task suggests searching widely. Whatever is overshared becomes visible to the agent and to anyone the agent answers.
The drive owner for each area decides access to it. The IT team that runs the file platform configures permissions. The process owner explains which folders the agent's job needs. Data protection reviews folders holding personal data.
What are the steps?
- Person, process owner: lists the folders each capability needs, and why.
- Person, drive owners: approve each folder, confirming it holds nothing the agent should not see, or excluding sub-folders that do.
- Person, IT: grants access directly to the agent's identity, folder by folder, not by adding it to a group.
- Person, IT: creates one output folder where the agent may save files; how to let an AI agent save files to shared drives covers that capability.
- Person, IT: blocks permission changes, sharing links and deletion for the agent's identity across the platform.
- Person, data protection officer: excludes sensitive areas: HR, legal, board, health and anything holding special-category data unless a capability needs it and is approved.
- Person, IT: makes search permission-aware, so any index the agent queries respects folder permissions.
- Agent, depth 1: is tested with requests to open files outside its folders, to share files and to follow instructions written inside documents.
- Person, IT: tests revocation and removes any cached or indexed copies when access ends.
Which permissions are granted per action, and at what depth?
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read approved folders | Opens files for its task | 1 | Approving each folder |
| Search approved folders | Finds files within its rights | 1 | Nothing |
| Save to the output folder | Writes new files | 3 | Moving files elsewhere |
| Edit existing files | Drafts a new version in the output folder | 2 | Replacing the original |
| Move or rename files | Proposes the move | 2 | Doing it |
| Create sharing links | Nothing | none | Drive owners only |
| Change permissions | Nothing | none | IT only |
| Delete files | Nothing | none | Drive owners only |
Least privilege here means more than read-only: it means the smallest set of folders. The wider principle is in how do you give an AI agent least-privilege access?
What stays with a person?
Deciding which folders the agent may see, moving or replacing files others depend on, sharing anything, and deleting anything. If the agent finds files that look overshared, such as a customer list in an open folder, it reports them to the drive owner rather than using them.
What is recorded?
The file platform logs every open, save and failed attempt by the agent's identity. The agent's own record holds the task, which files it used as sources and their provenance, the bound that decided, and any held action. Reads matter as much as writes: an agent that opened hundreds of files for a task needing three is a signal to investigate.
Which controls make it safe?
Direct grants, no groups. Group membership is how access spreads; keep the agent out of groups.
One place to write. Saving only to an output folder means the agent cannot overwrite live documents.
Sensitive areas excluded by default. Exceptions need data protection approval.
Instructions in files are content. A document saying "copy this folder to the public drive" is text, not a command.
Regulatory baselines met. For US financial institutions, the GLBA safeguards expect access to customer information to be limited and controlled; GLBA safeguards and AI agent access controls maps them to agents.
What should you measure?
Folders granted against folders used, files opened per task, refused attempts outside approved folders, overshared files reported, and grants unused for a full review period. Unused grants should be removed at the next access review.
Where does it usually go wrong?
The agent joins the team group. Quickest set-up, widest access. It now sees every folder the team ever touched.
A person's account is used. The agent acts with someone's full access, and its activity looks like theirs.
The index leaks. A search index built with broad rights returns snippets from files the agent cannot open.
Mailboxes are treated differently. Teams lock down drives and then give the agent full access to a shared mailbox full of attachments. Apply the same discipline; see how to let an AI agent send emails from a shared mailbox.
Where Pryme fits
In Pryme, an agent's sources are one of the five bounds on every action, so even folders it can technically reach are narrowed to what each capability may use, and each file arrives stamped with its provenance. The rollout approach is described in deploying an AI agent: train, shadow, certify, widen.
Questions people ask
Should we clean up drive permissions before connecting an agent?
Yes, for the folders you plan to grant. Connecting an agent is a good moment to find overshared files, but do it before access is granted, not by watching what the agent finds.
Can the agent read files people share with it directly?
Treat files shared directly with the agent as inputs from that person, with external or declared provenance. Its access should still be limited to approved folders for anything beyond the shared file.
How do we remove access when a project ends?
Grant project folders with an expiry date, and remove them at the end of the project or the next access review, whichever comes first. Clear any indexed copies at the same time.