--- title: "Copilot Oversharing: Review Access and Notice Duties" description: "Respond to Copilot oversharing with GC AI. Check access evidence and contract notice duties, then give IT and the account owner a reviewed instruction." canonical: "https://gc.ai/blog/copilot-oversharing-confidential-contract" last_updated: "2026-11-11" --- # Copilot Oversharing: Review Access and Notice Duties > Respond to Copilot oversharing with GC AI. Check access evidence and contract notice duties, then give IT and the account owner a reviewed instruction. **Published:** 2026-11-11 | **Category:** Resources | **Author:** Caitlin Price --- A sales employee receives a Microsoft 365 Copilot answer quoting negotiated pricing from a confidential customer contract. IT finds that a broad SharePoint group grants access now and is still establishing whether the employee had that access when the answer appeared, and whether anyone shared the response. The customer agreement requires notice within 24 hours after discovery of unauthorized access. Counsel must assess that clock while IT preserves evidence and contains further exposure. Microsoft's [security guidance]() explains that Copilot operates within existing Microsoft 365 permissions. That makes this an authorization question as well as an IT incident: did the employee satisfy the agreement's access conditions, and has the notice obligation been triggered? IT still has to establish the access path and recipients. [GC AI]() is turnkey legal AI software built for in-house counsel. It is trusted by 2,100 companies, including 300 public companies, with organizations such as Lockheed Martin and TIME using the platform. GC AI helps counsel compare the agreement and company access rules with IT's verified findings, then prepare a cited decision record and owner instructions while the notice deadline is under review. ## How Did Copilot Surface the Confidential Contract? Your IT team preserves the Copilot interaction and reconstructs who could access its source when the answer appeared. Containment and Legal's notice review proceed in parallel. Four facts anchor the incident decision: > **Discovery:** When the company learned of the answer and who escalated it. > **Source and answer:** The contract version and location, available prompt and response, citations, timestamp, and account. > **Audience and access:** The recipient, any sharing or forwarding, and event-time permissions, grants, and group membership. > **Containment:** What changed and when, preserved records, and any remaining access or copies. Microsoft's [Copilot interaction schema]() and SharePoint [data access governance reports]() identify useful evidence, but their availability varies by tenant. Today's permissions cannot establish historical access or every recipient. Your IT team compares historical records with current access, corrects confirmed overbroad grants, and leaves other possible sharing paths open if the evidence is incomplete. ## Did the Contract Permit That Employee's Access? Contract authorization is a separate test. The employee must need the information to perform the agreement and be bound by confidentiality obligations. Those facts come from the account owner and employment records, separate from SharePoint permissions. **Illustrative Contract Provision:** The customer agreement defines Authorized Personnel as follows. > Employees who need the Confidential Information to perform this Agreement and are bound by confidentiality obligations. The same hypothetical agreement requires notice within 24 hours after discovery of unauthorized access to the customer's Confidential Information. The company's position restricts negotiated customer contracts to the account team and Legal. The employee's account role, confidentiality obligations, event-time group membership, and forwarding recipients remain unconfirmed. Counsel records those gaps and evaluates the 24-hour discovery trigger against the agreement and amendments while IT continues the investigation. Contractual customer notice and statutory notice are separate decisions. [Privacy counsel]() should assess the information involved, affected people, jurisdictions, and applicable legal duties. Commercial pricing alone does not establish a personal-data breach. If the material includes legal advice, counsel must separately [assess privilege](); a confidentiality label does not decide it. ## Which Controls Help Contain Copilot Oversharing? Start by correcting verified overbroad SharePoint permissions. Microsoft's [Restricted Content Discovery]() can limit discovery in the meantime, though anyone with access can still open the file directly. | **Control** | **What it changes** | **What IT verifies** | | --- | --- | --- | | SharePoint permission correction | Restricts who can directly open the confidential contract | Effective time, approved audience, and any other access paths | | Restricted Content Discovery | Temporarily limits supported Copilot discovery routes; direct access remains | Site scope, propagation, and routes still available | | [Sensitivity labels]() | May apply encryption or use rights when configured | Label settings and enforced permissions | | [Copilot DLP]() | Restricts supported content processing; directly uploaded files are outside this DLP location's scanning | Covered interactions, exclusions, and effect on content versus citations | Legal's incident record should identify the permission fix, its effective time, and what remains unresolved about earlier responses or recipients. ## Prepare the Contract and Incident Decision Record With GC AI While IT reconstructs access, GC AI helps counsel prepare a cited decision record from the approved agreement and amendments, company access position, and IT's findings. A GC AI Project keeps the matter's materials together; Legal checks workspace access and handles privilege separately. The draft separates the contract's authorization test and notice deadline from confirmed evidence and unresolved facts, so counsel can approve the next step. **Example Prompt** > From the supplied agreement and amendments, approved access position, and IT's findings, draft a cited decision record. Test both Authorized Personnel conditions, identify the notice trigger, recipient, method, and deadline, and list missing evidence and next owners. Draft internal instructions; do not send any customer notice. **Illustrative Decision-Record Finding** > Current broad-group access is confirmed, but event-time membership, contractual need to know, applicable confidentiality obligations, and forwarding recipients remain unresolved. Assess the 24-hour discovery trigger immediately while IT and the account owner obtain missing evidence. Counsel checks that proposed finding against the cited agreement and IT's evidence before adopting it. GC AI's [Exact Quote]() opens the highlighted source passage behind a citation, so counsel can test the authorization definition and notice clause in context. For related statutory notice or preservation questions, GC AI's [Research]() provides analysis linked to original authorities for counsel to review. ## Who Owns the Response and Notice Decision? Give each owner a clear assignment while Legal assesses the notice clock. | **Owner** | **Decision or action** | **Timing** | | --- | --- | --- | | IT | Preserve response and access records; establish historical permissions, containment, and earlier copies | Immediately; report available findings to Legal | | Account owner | Confirm the employee's need to know, confidentiality obligations, and forwarding | As soon as available for the notice assessment | | Legal | Apply both authorization conditions, assess contract and statutory notice, and authorize any communication | Review now; act by any applicable deadline | | Notice owner | Send only Legal-approved notice and retain proof of delivery | If required, by the applicable deadline | The record stays open until counsel documents the notice decision and IT verifies containment. To evaluate this workflow, use a past incident your team has permission to review. Compare GC AI's cited draft with counsel's decision, unresolved evidence, notice deadline, and owner handoff before relying on it in a live matter. [See GC AI in Action](https://gc.ai/book-a-demo?cta=inline-demo) ## Frequently Asked Questions ### Does Copilot Keep Things Confidential? Copilot uses existing Microsoft 365 access permissions, which may be broader than a customer agreement permits. For a specific incident, establish who accessed the document, who received the answer, and whether the contract authorized the disclosure. The [Copilot privacy guide]() covers the broader account and data-handling questions. ### Does Copilot Share Your Chats? Yes, when your organization permits it. Users can share a conversation or an individual Copilot response through a link. Sharing does not grant access to the underlying Microsoft 365 files, but recipients can see content included in the shared answer. Your IT or security team should review available [Copilot sharing events and link-access records](), then investigate whether recipients continued the conversation or retained a copy. ### Does Removing File Access Remove Earlier Copilot Responses? No, not necessarily. Removing SharePoint access does not establish that previous answers, shared responses, or retained copies have disappeared. Your IT or security team should identify the affected [Copilot interaction records]() and copies, then handle them under the approved incident and preservation process. ### Does Every Copilot Oversharing Event Require Customer Notice? No. Notice depends on the agreement's definition and trigger, verified incident facts, and any applicable law. Technical access alone does not establish contractual authorization. Legal should determine when any notice clock began, who must be notified and how, and what unresolved evidence needs urgent attention.