As businesses move from employees occasionally using AI tools toward AI assistants and agents that can search files, analyze information, interact with applications, and execute workflows, an increasingly important question emerges:<\/p>\n
What information should AI actually be allowed to access?<\/strong><\/p>\n Answering that question requires more than choosing an AI platform.<\/p>\n Organizations need to understand their identities, permissions, data, security controls, and business processes before giving AI greater autonomy.<\/p>\n A useful order of operations is:<\/p>\n Identity \u2192 Permissions \u2192 Data Classification \u2192 AI Access \u2192 Workflow Automation<\/strong><\/p>\n That sequence also fits naturally into our Build. Protect. Accelerate.<\/strong> approach to business technology.<\/p>\n Before AI can safely accelerate the business, organizations need to build the right foundation and protect the information AI will encounter.<\/p>\n On August 28, 2026, Google announced an open beta of Gemini-powered AI classification for Google Drive<\/strong><\/a>.<\/p>\n The capability uses Gemini to evaluate files and automatically apply administrator-defined data classification labels.<\/p>\n Those labels can then help organizations apply controls around:<\/p>\n But perhaps the most interesting part of Google’s announcement wasn’t the classification technology itself.<\/p>\n Google connected data classification directly to the rise of AI agents, explaining that classification can help prevent agentic workflows from accessing and autonomously acting on sensitive information.<\/p>\n That is an important signal.<\/p>\n The emerging enterprise AI architecture increasingly assumes that AI agents will encounter governed data<\/strong>.<\/p>\n In other words, the long-term strategy cannot simply be:<\/p>\n Teach employees not to give sensitive information to AI.<\/strong><\/p>\n Organizations also need technology controls capable of determining what data users, applications, and eventually AI agents are permitted to access.<\/p>\n This trend isn’t limited to Google Workspace.<\/p>\n It reflects a much larger shift in how businesses should think about AI governance.<\/p>\n When businesses begin discussing AI governance, the conversation often starts with questions such as:<\/p>\n Those are good questions.<\/p>\n But they only address part of the problem.<\/p>\n Imagine an AI agent with permission to search an organization’s files, summarize customer information, prepare proposals, update a CRM, send communications, or initiate workflows.<\/p>\n The AI may be functioning exactly as designed.<\/p>\n The problem arises if the underlying permissions allow it to access information it never should have encountered.<\/p>\n At that point, the problem isn’t primarily the AI.<\/p>\n The problem is the data-governance architecture underneath it.<\/strong><\/p>\n Poor permissions are not a new cybersecurity problem.<\/p>\n Businesses have struggled for years with shared drives, broadly accessible folders, former employee permissions, duplicated documents, unmanaged cloud applications, and employees accumulating access as their responsibilities change.<\/p>\n Historically, some of those weaknesses remained hidden because a human employee still needed to deliberately find and use the information.<\/p>\n AI changes that dynamic.<\/p>\n An AI system capable of searching thousands of files can potentially discover information much faster than a human user.<\/p>\n An AI agent capable of taking actions can go one step further.<\/p>\n That means businesses should increasingly think about AI access as an extension of identity and access management.<\/p>\n The question isn’t simply:<\/p>\n \u201cCan this employee access the AI?\u201d<\/strong><\/p>\n It is also:<\/p>\n \u201cWhat can the AI access while acting on behalf of this employee or business process?\u201d<\/strong><\/p>\n That distinction will become increasingly important as organizations deploy more autonomous AI capabilities.<\/p>\n For many small and mid-sized organizations, I recommend thinking about AI adoption in five layers:<\/p>\n First, determine who or what is accessing the environment<\/strong>.<\/p>\n That includes employees, administrators, contractors, vendors, applications, service accounts, and eventually AI agents.<\/p>\n Strong identity controls can include:<\/p>\n If identity is weak, everything built above it inherits that weakness.<\/p>\n Next comes what each identity is allowed to access<\/strong>.<\/p>\n Organizations should understand whether users have access based on their actual business responsibilities.<\/p>\n Questions include:<\/p>\n The principle of least privilege becomes even more important as AI enters business workflows.<\/p>\n This also aligns with Zero Trust<\/strong><\/a> principles, where access is not implicitly trusted simply because a user, device, or workload is inside the organization’s environment.<\/p>\n An AI agent should not gain broad access simply because doing so makes automation easier.<\/p>\n Once identity and permissions are understood, the organization needs to understand the data itself<\/strong>.<\/p>\n Not every document requires the same protection.<\/p>\n A practical classification model might distinguish among:<\/p>\n Public<\/strong> \u2014 information intended for public distribution.<\/p>\n Internal<\/strong> \u2014 normal business information intended for employees.<\/p>\n Confidential<\/strong> \u2014 sensitive business, customer, financial, or operational information.<\/p>\n Restricted<\/strong> \u2014 highly sensitive information subject to regulatory, contractual, legal, or significant business-risk requirements.<\/p>\n The exact labels matter less than consistently identifying which information requires greater protection.<\/p>\n This is where technologies like Google’s Gemini-powered Drive classification become particularly interesting.<\/p>\n AI itself can potentially help organizations govern the enormous amount of unstructured data that would otherwise be difficult to classify manually.<\/p>\n The objective is not merely to label documents.<\/p>\n Classification creates context that other security and governance systems can act upon.<\/strong><\/p>\n Only after understanding identities, permissions, and data does the AI access question become much easier to answer.<\/p>\n Organizations can begin establishing rules such as:<\/p>\n This is a much stronger governance model than simply publishing a list of approved AI tools.<\/p>\n Instead of asking employees or AI systems to continuously decide what is sensitive, the technology environment already knows how information should be treated.<\/strong><\/p>\n Now the organization is ready for the most exciting part:<\/p>\n Acceleration.<\/strong><\/p>\n Once identities, permissions, data, and AI access are appropriately governed, businesses can more confidently automate workflows.<\/p>\n An AI-enabled workflow might:<\/p>\n But automation should come last\u2014not first.<\/p>\n Otherwise, businesses risk automating processes they do not fully understand using data they do not adequately control.<\/p>\n The objective should be:<\/p>\n Govern first. Automate second.<\/strong><\/p>\n This progression maps directly to our Business Technology Framework<\/a>:<\/p>\n Before sophisticated AI deployment, businesses need visibility into their technology environment.<\/p>\n That includes:<\/p>\n You cannot effectively govern an environment you do not understand.<\/p>\n Protection increasingly extends beyond endpoint security, antivirus, and firewalls.<\/p>\n It includes:<\/p>\n The goal is not to prevent employees from using technology.<\/p>\n It is to create guardrails that allow technology to be used safely<\/strong>.<\/p>\n Only then should organizations aggressively expand AI and workflow automation.<\/p>\n This is where AI can begin connecting information and business processes at scale.<\/p>\n Instead of asking:<\/p>\n \u201cWhere can we use AI?\u201d<\/strong><\/p>\n leadership can ask:<\/p>\n \u201cWhich governed business processes should we accelerate with AI?\u201d<\/strong><\/p>\n That’s a much more strategic question.<\/p>\n AI isn’t the only reason organizations should improve data governance.<\/p>\n In February 2026, the National Institute of Standards and Technology (NIST) released an initial public draft of its Data Classification Practices<\/em><\/a> guide.<\/p>\n NIST describes data classification as a way for organizations to discover, identify, and label unstructured data so that valuable or sensitive information can be better protected.<\/p>\n NIST also connects data classification with emerging security capabilities such as Zero Trust Architecture and AI model training.<\/p>\n That makes classification increasingly relevant to several business priorities at once:<\/p>\n Organizations that establish stronger data governance today aren’t simply preparing for AI.<\/p>\n They are improving the underlying architecture of their cybersecurity and compliance programs.<\/p>\n This is also why AI governance cannot belong exclusively to IT.<\/p>\n IT can implement identity systems.<\/p>\n Cybersecurity teams can configure access controls.<\/p>\n Compliance professionals can interpret requirements.<\/p>\n Application owners can understand business workflows.<\/p>\n But leadership still needs to determine:<\/p>\n NIST’s AI Risk Management Framework<\/a> places Govern<\/strong> across the AI risk-management lifecycle for exactly this reason.<\/p>\n AI governance ultimately connects technology decisions to organizational risk.<\/p>\nGoogle’s Latest AI Security Capability Is a Sign of What’s Coming<\/h2>\n
\n
The AI Governance Conversation Has Been Too Focused on the AI<\/h2>\n
\n
AI Changes the Consequences of Poor Permissions<\/h2>\n
The Right Order of Operations for Business AI<\/h2>\n
1. Identity<\/h3>\n
\n
2. Permissions<\/h3>\n
\n
3. Data Classification<\/h3>\n
4. AI Access<\/h2>\n
\n
5. Workflow Automation<\/h2>\n
\n
How This Fits the Build. Protect. Accelerate. Framework<\/h2>\n
![\"Three-tier](\"https:\/\/cmitsolutions.com\/detroit-mi-1232\/wp-content\/uploads\/sites\/246\/2026\/06\/pyramid-300x164.png\")
<\/p>\nBUILD: Create the Foundation<\/h3>\n
\n
PROTECT: Govern Access and Information<\/h3>\n
\n
ACCELERATE: Give AI Controlled Access to the Business<\/h3>\n
Data Classification Is Becoming More Important Beyond AI<\/h2>\n
\n
AI Governance Is a Leadership Issue<\/h2>\n
\n
![\"CMIT](\"https:\/\/cmitsolutions.com\/detroit-mi-1232\/wp-content\/uploads\/sites\/246\/2026\/06\/Assessment-Image-1-300x167.png\")
<\/p>\n