By Kapil Raval · October 2026 · 5 min read
Picture a geologist asking her company’s new AI assistant about a well. The answer comes back fast and well organised. It also draws on a partner’s interpretation report she was not allowed to open.
Nobody hacked anything. The assistant was built the usual way, and the usual way forgets who is asking.
For twenty years enterprises have treated data silos as a problem to solve. Different teams own different data, under different rules, in tools built for their own work, and integration projects keep trying to tear down the walls.
Those walls were doing something useful. The finance system answered finance users. The subsurface store answered people with subsurface access. If you could log in to a system, you could see its data, and if you couldn’t, you couldn’t. Every silo ended up as an entitlement boundary.
Entitlements are the rules that say which person may see which data. In a large company they are not a nice-to-have. Regulators, joint-venture partners and data licences all depend on them.
The common way to give AI access to enterprise data is to copy it. Pull the documents out of the systems they live in, extract and clean the text, break it into chunks, and load it into an index the model can search.
The data travels. The entitlements stay home.
Once the copy exists, it answers with the reach of whatever account built it. Usually that is a service account with broad read access. I think of this as the borrowed badge: the AI walks into every room on a badge the user was never issued. Anyone who can query the assistant can reach anything the badge could. In an enterprise, that ends the project the day someone notices.
Some teams patch this in the prompt. They tell the model not to reveal restricted information. But the prompt is a request. A well-worded question gets around it, and anyone who has tested these systems has watched it happen.
The energy industry shows the problem clearly because it has already done the hard part. OSDU, the industry’s open data platform standard, attaches an access control list and a legal tag to every record. Operators have spent years moving subsurface data onto governed platforms built on it. Each record says who may see it and the legal terms it was acquired under.
The knowledge and interpretation of that data live somewhere else: in well reports, drilling reports, regulatory submissions and interpretation notes, written for people to read. A geologist working a well still opens a dozen of them, and the next person repeats the work a month later. An AI assistant could read them in seconds.
To make that work, the usual approach copies the documents into a search index the AI can query. On the platform, those documents sit under the same access lists and legal tags as everything else. In the index, they lose them. The operator spent years building those entitlements, and the AI project walks straight around them.
So the choice looks like this. Copy the data and lose the entitlements, or keep the data governed and go without AI. Many projects stall right there.
The better pattern is simple to state. The question runs as the person asking, so the AI never holds a broader credential than the user. The system of record decides what that user may see, on every question, at the moment it is asked. The rules for what the AI may do sit outside the model, where it cannot read or change them. If the user lacks the right, the answer is no. And every answer carries its sources, so the user and the compliance team can open the record it came from.
Kadri Umay, a member of the OSDU Management Committee, makes a related argument in a recent piece on moving from data mesh to data substrate. Governance has to be enforced outside the model, and data should be exposed as governed capabilities rather than raw tables. I agree with him. The pattern above is one practical form of it.
Documents cannot be queried in place. A platform that indexes record metadata does not index the text inside a 200-page PDF, so some preparation is unavoidable. The test of a good design is what happens to that prepared text.
It must hold no rights of its own. Each piece points back to the record it came from. When a question arrives, the system asks the platform which of those records this user may see right now and uses only those. The prepared text is a convenience for the AI. The platform remains the authority for access. If someone’s access is revoked at nine in the morning, their next question returns nothing from that record.
Modern vector databases support metadata filters, so why not copy the access lists into the index and filter on them? You can. But this is a second entitlement system, and it is only as current as its last sync. Group memberships change, legal tags expire, partners leave a joint venture. Copying the rights on a schedule is the same broken pattern with a shorter delay.
The honest cost of doing it properly is speed. Checking rights and gathering sources on every question is slower than searching a copy. A sourced answer in a minute beats an instant answer nobody can trust, and users accept the wait when they can see the work being done.
There is no lake to build first. The data stays where it is, so the first useful question can be asked weeks after the decision. Decades of reports, already paid for, can answer questions. Compliance can audit any answer, because it shows its sources and ran under the asker’s rights. And because the approach uses the platform’s standard interfaces, it works the same on any cloud.
Does your system answer as the user, or through its own service account?
Where are rights checked, and how old is that check by the time the answer arrives?
What happens to your prepared copy when a record is deleted or its access changes?
Can you show me the source of this answer, and can my compliance team see it too?
Then test the answers. Revoke access and ask the same question again. Delete the source record and see if the answer disappears. Ask for the evidence behind a confident answer. Try to make the system reveal something the user is not allowed to see.
If the architecture fails these tests, it is not governed AI. It is an ungoverned copy of your data with a persuasive interface.
Do not ask whether the system can answer your questions. Ask whether it can answer them as you, from data you are allowed to see, with evidence you can verify. If it cannot, do not give it your data.
RCI advises AI companies on go-to-market, including one working on this problem.