What does the myth say?
That an AI employee is only as good as what it can see, so to be useful it must be given broad access: every system, every record, every document, connected once so it can learn the business. The belief is what makes security leads refuse pilots and data protection leads refuse to sign, and they are right to refuse the version it describes: a single credential with access to everything is the largest possible blast radius attached to the least accountable actor.
The examination is about how much a role actually needs, and how the platform bounds it.
Where does the belief come from?
From consumer assistants that ask to read everything, from enterprise search products whose value is breadth, and from vendor pitches that promise an AI which knows your whole company. It also comes from a real property of models: more context can mean better answers. And from the way many integrations are built, with a personal login or an admin token because it is the quick way to make the demo work.
Each is a reason the belief exists; none is a reason a business function needs it.
What is true in it?
That a Digital FTE with no context produces generic work, which is why the Brand Brain is pre-filled and confirmed. That some functions need access to sensitive systems to be useful at all: a Finance Controller FTE needs the ledger and the bank feed, a Recruiter FTE needs the applicant tracking system. That a role given too little scope will escalate constantly and frustrate everyone. Scope has to match the remit, and the remit has to be real. The myth's error is in assuming that the remit is the whole company.
A Finance Controller FTE needs the ledger. It does not need the helpdesk, the CRM, or anyone's inbox.
What does the mechanism actually do?
Each connection on ftes.ai is a dedicated account or token for one role and one tool, created by whoever owns access, with the narrowest permissions the tool allows for the remit, scoped to one property, encrypted with a separately held key, never shown after entry, and revocable from the workspace in one logged action. Isolation between organizations and between properties is enforced at the data layer on every query, including background jobs. The Brand Brain holds voice, facts, policies, and preferences about the business, never personal data about individuals; drafts follow the retention of the underlying activity. Role-based permissions govern every protected action in the workspace, and the audit trail records every read and proposal.
The security checklist in the library gives the twelve checks that verify each of these.
- Per role, per tool, per property: dedicated, narrow, encrypted, revocable
- Isolation: data layer, every query, including jobs
- Memory: business knowledge, no personal data
Which functions need no sensitive data at all?
More than most leaders expect. Search visibility and content need the site, the console, and approved sources. Guest questions, opening-hours enquiries, and administrative support need a fact sheet and a knowledge base. Social presence needs the accounts and the reply rules. Ledger-level reconciliation needs the ledger and the bank feed but no customer records beyond what the ledger holds. Interview scheduling needs calendars. A practice, a firm, or a property business can run a first year of Digital FTEs entirely outside patient, client, or guest records, and the industry pieces in the library set out how.
Wider access, when a later function would need it, is a separate compliance decision with its own review, made in writing.
How can you check for yourself?
For each connection a role holds, open the tool's own admin and read the account's permissions; confirm it is dedicated, not a person's login, and that it cannot do what the remit forbids, by attempting the forbidden action and seeing it refused at the tool. Open the role's Memory tab and look for personal data; there should be none. Ask in writing how a request for another organization's or another property's record behaves. Disconnect one tool and find the disconnection in the audit trail. Record the confirmations with a date, and repeat them at the quarterly connection review.
A vendor that cannot show scope at the tool, isolation at the data layer, and a memory without personal data is offering the access the myth describes.