When an AI tool becomes a data path
The moment an assistant can read mail, files, or tickets, it is no longer only a model. It is a data path with a blast radius.
Paste is a data path. Connectors are a data path. Retrieval is a data path. “Helpful memory” is a data path.
AI tools get sold as conversation. The security story starts when generation can move data. The one-sentence test is blunt: did anything leave the session boundary?
Generation is not movement. A model that only returns text inside a sealed session mostly risks wrong answers and leaked prompt content. The moment the same face can read mail, open files, hit tickets, or pull from an index, you no longer have “just a model.” You have a path: who triggered it, what left, what was stored, and what can be replayed.
Blast radius follows the path, not the branding. Read-only is smaller than write. One-shot is smaller than a loop. A human gate that can actually stop a hop is smaller than a background job that keeps going. Treat every connector as a door until you can name what is on the other side.
Four practical questions before you enable the next “assistant” feature:
- What left the boundary — prompt, file, ticket field, retrieved chunk?
- What persisted — chat history, provider logs, memory, export, embed index?
- Who can trigger the next hop — only this user, a shared workspace, an agent loop?
- Can you revoke mid-path — kill the connector, wipe the thread, stop the run?
This is AI × Data Security in one field note: generation meets movement. Named platforms can appear later when a Learn-backed fact is required. They are not the opener and not the product being sold here.