AI assistants can become embedded in workplace tasks before anyone has properly decided what they should be allowed to access or do, argues Itamar Golan, general manager of Prompt Security at SentinelOne. His practical point: review an assistant’s permissions when it is connected, not after colleagues have built their work around it.
Watch Desk analysis
What happened
In an opinion article for CTech, Golan says security teams can be swamped by the latest model announcements while missing less flashy changes to how AI is used inside a business. An assistant connected to an inbox or other service may gain the ability to read information and take actions, even when the organisation has not agreed what access is appropriate.
Golan recommends checking what data and actions an assistant can reach, what task that access is meant to support, and which actions should still require approval. He also says businesses should review the previous assistant’s permissions when an employee switches tools. A new assistant may be useful; its predecessor need not keep the keys.
Why it matters
The boundary between reading information and acting on it can look small in an interface, but it is a real change in authority. Checking permissions when a tool is first connected gives an organisation a chance to decide what it is comfortable delegating before that tool becomes part of someone’s daily routine.
The article is an industry executive’s argument, not a general security standard. Its value is in the concrete questions it offers teams, rather than in treating every assistant as an imminent incident.
Our read
Security attention should follow access and capability, not the volume of headlines. If an assistant can read business data, send messages or alter records, those permissions deserve a deliberate decision and a clear purpose. That is less dramatic than debating the future of AI, but considerably more useful on a Tuesday morning.
What to watch
- Whether companies review permissions when employees connect or replace assistants.
- Whether sensitive actions require approval, rather than relying on the tool’s apparent helpfulness.
- Whether access to the data an assistant can read matches the task it is meant to perform.
Discussion spark: Should companies require security approval before employees connect AI assistants to workplace data, or is a clear permissions review by the employee enough?
Sources and evidence
- AI headline fatigue is now a security risk | Ctech (30 October 2026, 08:59 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.