When an Enterprise AI Assistant Becomes a Map of Corporate Strategy

Summary

This briefing argues that a compromised or misused enterprise AI assistant could reconstruct a company’s strategy by joining individually permitted fragments from email, finance, engineering, HR, suppliers, calendars, documents, and workflow systems. The resulting picture might include product plans, launch timing, pricing, supplier dependencies, technical weaknesses, acquisitions, or expansion plans even when no single source contains the complete strategy. The author compares this risk with the lesson associated with Cambridge Analytica: the sensitive asset may be the relationship between data fragments, not the fragments themselves. The proposed threat chain is broad access, cross-system collection, inference, persistence in memory or another agent, and conversion of the inference into an email, payment, record change, disclosure, or workflow action. Because each individual request may appear authorized, conventional identity, token, network, and resource-level controls may report normal activity while missing the combined consequence. The briefing therefore separates access authority, inference or join authority, and effectuation authority. It argues that permission to read A and B should not automatically imply permission to infer from A+B, and permission to infer should not imply permission to act. Probabilistic guardrails and post-event logs may help detect problems, but the author says high-consequence operations need an independent execution-boundary control that checks the exact operation, destination, parameters, authorization, purpose, freshness, replay state, revocation state, and protected system state, failing closed when mandatory facts cannot be verified. The proposed controls include constrained or non-joinable data domains, protected reconstruction, controlled memory, candidate actions held in a non-effective state, and final output-release enforcement. The article also explains why Zero Trust remains useful but does not by itself resolve authorization for a cross-domain inference and its resulting consequence. It contrasts AI systems with human insiders on access scope, correlation speed, memory, persistence, and ability to invoke tools. The accompanying technical materials are individual IETF Internet-Drafts and are explicitly described as working documents rather than approved standards or IETF consensus.