The direct answer is to map every person and process that can read source material, change prompts or policies, approve drafts, export content, or publish, then remove anything not required by a named role. Audit the whole chain: the AI workspace alone is not the workflow.
Draw the access map
List the AI provider workspace, identity provider, shared drives, document repositories, browser extensions, no-code connectors, source-control project, content management system, analytics, and backup locations. For each one, record owners, administrators, members, guests, service accounts, API keys, OAuth grants, public links, and recovery contacts.
NIST SP 800-53 Rev. 5 includes account-management and least-privilege controls. The official publication applies least privilege to users and processes acting on behalf of users. Include scheduled jobs, integration identities, and publishing bots instead of auditing only employees.
Define roles before changing grants
Use clear roles such as writer, source researcher, reviewer, approver, publisher, administrator, and auditor. Writers may create drafts but should not automatically manage billing or publish publicly. Reviewers need sources and change history; publishers need the approved artifact, not unrestricted access to every private source folder. Administrators should not use elevated access for daily writing.
Mark conflicting duties. A high-risk workflow should not let one unreviewed account change policy, generate content, approve it, and publish. Where staffing is small, use explicit approval records and alerts to compensate rather than pretending separation exists.
Inspect the hidden permissions
Review folder inheritance, shared links, group membership, old invitations, personal access tokens, app passwords, browser profiles, connected-drive scopes, webhook secrets, and credentials stored in scripts. Identify former employees, vendors, and test accounts. Check whether an integration still uses a departed person's OAuth grant or recovery email.
The NIST Generative AI Profile treats third-party technologies, data, and service providers as part of generative-AI risk management. Record the provider plan and tenant because privacy and administrative controls can differ across plans.
Test permissions with safe accounts
Use test content to verify each role. A writer should not see restricted customer material. A reviewer should be able to open cited sources. A guest should not export the entire workspace. A publishing service account should accept only approved content and should not expose its secret to ordinary users.
Attempt the forbidden actions as well as the allowed ones. Confirm denial in the product and in audit logs. Do not test with real confidential files or live publishing when a private test workspace is available. Rotate any credential found in an unsafe location and update the approved secret store.
Close gaps and preserve evidence
Remove stale accounts and links, narrow connector scopes, transfer ownership, and set expiration dates for temporary access. Save the audit date, system, identity, role, permissions kept, permissions removed, reviewer, and next review. Avoid copying secret values into the report.
Recheck after staff changes, provider migration, major model updates, new connectors, or an incident. Monitor for new public links, administrator grants, failed sign-ins, and publishing actions outside the normal approval route.
The audit is complete when each access path has an accountable owner, a documented purpose, the minimum useful privilege, and a successful test showing that unauthorized actions are blocked.
Sources
- Security and Privacy Controls for Information Systems and Organizations — National Institute of Standards and Technology, Sept. 23, 2020
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile — National Institute of Standards and Technology, July 26, 2024