FIELD NOTE / MICROSOFT 365 / TEAMS / AI GOVERNANCE
The meeting summary disclosed what the transcript kept restricted
A restricted transcript produced a summary in a broader Team and SharePoint site. A fluent set of minutes carried a grievance and commercial position from a controlled Teams meeting into a broad project workspace. Source read permission covers acquisition. Publication requires a separate approved purpose, recipient set and destination write.
The situation: a safe source, an unsafe derivative
COMPOSITE SCENARIO: documented product behaviour combined with recurring operational failure patterns. No client-specific delivery claim is attached. Consider a Perth engineering and operations firm running a fortnightly Teams meeting with staff, a delivery partner and occasional subcontractors. The ordinary agenda covers programme, safety and procurement. During one meeting the partner leaves, and a manager discusses an identifiable workplace grievance and a confidential commercial concession. The meeting continues under the same invitation and transcript.
The organiser's OneDrive holds the recording and transcript. Access to those artifacts is limited to the expected internal invitees. Later, an authorised employee asks an AI meeting assistant to draft minutes. A custom workflow posts the result to a SharePoint project page and a broad Teams channel used by internal staff and partner contacts. The summary names the employee's function, describes the allegation and states the negotiation floor. Those derived details disclose the restricted subject without quoting the transcript. Search, notifications and later Copilot queries make the derivative easier to discover than the source.
Nothing here requires Copilot to bypass permissions. Microsoft documents that Microsoft 365 Copilot grounds on content the signed-in user may access, and Teams recording/transcript access follows meeting roles, invitation and OneDrive or SharePoint permissions. The failure occurs after legitimate reading: a person or automation creates new text and publishes it under a different destination boundary. Native intelligent recap, a copied recap, a manually edited document and a custom Graph application must be assessed as different processing paths.
Contain disclosure without destroying the record
Pause the publishing workflow and revoke its destination write path. Restrict or withdraw the broad summary using the approved incident process, but do not indiscriminately delete the transcript, recording, prompt, response or audit trail. Those artifacts may be required to investigate the disclosure, correct the record, satisfy retention or legal-hold duties and identify downstream copies.
Record meeting ID, source artifact IDs, organiser, participants, transcript segments, generation time, user or application identity, model and prompt configuration, output IDs, destinations, notifications, links and effective audiences. Preserve available Microsoft Purview audit events: Microsoft describes Copilot audit records that can reference the user, time, workload, accessed resources, meeting or chat identifiers and prompt/response message IDs. A custom application also needs its own immutable action log because native audit evidence cannot prove every transformation performed outside the supported service.
Notify the information owner, privacy or people authority, security lead and records owner according to the classified content. The project-channel owner may lack authority over privacy, employment and recordkeeping decisions. Ask recipients not to redistribute the summary and identify exports, email forwards, downloads, search indexes, caches, connector indexes and downstream agents. Removal from one Teams post proves that containment action only. Search retained and discovered copies through the lineage register.
Model derivative data as a new controlled object
Treat each generated output as an addressable derivative with lineage. Join the source meeting and artifact, exact segment references, processing identity, prompt and model/version, generation settings, extracted claims, human edits, classification decision, approver, destination, audience, label, retention class and publication event. Keep the original source immutable; corrections create a new derivative version with an explained disposition.
Evaluate each derived claim, its supporting segment and its destination. A paragraph can combine a low-risk programme update with one restricted sentence. Each material assertion needs a source pointer, confidence or uncertainty state, content class and permitted audience. Withhold unsupported statements for human review even when no sensitive source can be found. A plausible invention about a grievance or commercial promise can still cause harm.
Calculate the recipient set from the approved purpose, source-segment permissions and destination membership. Purpose matters because an employee may need transcript access to investigate an issue without being authorised to publish it in routine minutes. Recording consent covers capture. Later use, publication, retention and employment-process obligations require separate decisions.
Map the Microsoft controls to the boundary they actually govern
Teams meeting policies, templates, sensitivity labels and organiser options can govern whether recording/transcription occurs, who can record, and—where supported—who can access, copy or forward recording, transcript, chat and recap material. Microsoft notes that recordings and transcripts live in the organiser's OneDrive for non-channel meetings or the relevant SharePoint location for channel meetings, with permissions depending on meeting type and role. Verify the current licensed behavior in the tenant; do not publish a control design copied from a different meeting type.
Microsoft 365 Copilot accesses organisational content in the signed-in user's permission context, and its prompts and responses remain governed within Microsoft 365. Purview can provide sensitivity, DLP, retention, audit, eDiscovery and investigation capabilities for supported surfaces. These controls operate independently and in combination. Verify label propagation for each generated document and test whether DLP recognises the paraphrased sensitive subject.
A custom transcript processor adds another plane. Microsoft Graph supports organization-wide application permissions or resource-specific consent for transcript access, subject to tenant controls. An application that may fetch a transcript still needs an explicit allow-list of meetings, least-privileged identity, bounded processing purpose, approved destinations and a separate publication authorisation. A Graph read grant authorises acquisition only. Graph or SharePoint write access and business publication require separate approvals.
Test competing causes before selecting a repair
First, the meeting boundary may have been wrong: a sensitive agenda item remained inside a broadly invited meeting, or a partner left the call without being removed from continuing chat and artifact access. Second, the source boundary may be correct while the publication audience is wrong. Third, a destination may have inherited broader SharePoint or Teams membership than its display name suggests.
Fourth, the summariser may lack segment-level exclusions, so one restricted exchange contaminates routine minutes. Fifth, a copied or newly generated output may not carry the expected label or encryption, or its destination may not enforce the intended control. Sixth, a human may have edited, downloaded or forwarded an otherwise controlled recap. Seventh, the model may have fused speakers, removed qualifiers or invented consensus. Eighth, a custom app may use tenant-wide transcript permission where resource-specific consent or a narrower application access design was possible.
Build a timeline for each hypothesis and seek disconfirming evidence. Test membership at the event time and again at review time. Compare the native recap with the generated output and final posted version. Resolve every material sentence to transcript segments. Inspect the app identity, Graph grants, policy state, destination permissions, audit events and human edits. Do not blame “AI leakage” when a broad Team was the real publication decision, and do not blame permissions when the derivative itself is unsupported.
Introduce a controlled publication gate
Classify meetings before capture and classify exceptional agenda segments before discussion. When a grievance, legal advice, health matter or negotiation requires a narrower audience, use a separate restricted meeting or stop transcription for a clearly governed segment where policy, participant notice and operational needs allow. A coloured agenda marker is useful only when it triggers an actual change in people, capture or publication handling.
Generate an evidence-linked candidate, never an autonomous final record. The processor should preserve speaker and timestamp references, mark uncertainty and disagreement, detect restricted categories, and separate claims into destination-specific views. A broad project summary can say that an item moved to a restricted process without naming the person or substance. A restricted case record may contain the approved detail, but only in its controlled destination and after a named accountable reviewer accepts it.
Before publish, calculate the source-segment audience and destination audience, require their permitted intersection, verify classification and retention, and present the diff to a human approver. Use a scoped execution identity only after approval, then record the destination ID and re-read effective access. If the gate cannot prove audience, evidence or approval, it fails closed to a draft visible only to the reviewer. The no-AI option—manual restricted minutes or no transcript—is a valid architecture outcome where the control burden exceeds the value.
Verify people, claims, destinations and lifecycle
Use synthetic meetings with seeded phrases, speaker changes, euphemisms and near-matches. Test an organiser, authorised attendee, invited but absent user, later-added channel member, external participant, broad project member, restricted-case reviewer, application identity and prohibited persona. For each one, record source access, native recap access, draft access, destination access, notification exposure, search results and Copilot discoverability.
A broad summary must include approved routine decisions and omit the seeded restricted assertion and identifying context. A restricted summary must resolve every material claim to allowed transcript segments and remain absent for prohibited personas. The test pack must also reject invented decisions, merged speakers, unqualified allegations and publication where the source, purpose, destination or approver is unknown. Human approval should be tested as a control, including rejection, edit, expiry and attempted bypass.
Exercise revocation, correction, retention, eDiscovery and incident response. Remove a person's source access and determine what happens to native artifacts and already approved derivatives. Correct a source speaker attribution and prove how the derivative is superseded without erasing provenance. Search Purview and application logs using retained IDs. NIST's Generative AI Profile supports lifecycle risk mapping and measurement; OWASP's sensitive-information-disclosure guidance is a useful practitioner threat signal. Tenant-specific capture remains the source of the release decision.
Accept the narrow result and its limits
A passed pack proves only the tested meeting types, policies, identities, licenses, application version, destination classes and time window. Completeness, downstream consent and the approver's recognition of contextual sensitivity require separate evidence. Transcription quality, role changes, language, sarcasm and incomplete speaker attribution remain material limits.
Permissions enforce access. Purpose limitation requires a separate publication decision. Labels and DLP can reduce risk but must not be described as complete semantic controls. Audit records can show interactions and referenced resources without reconstructing every hidden model operation. Product behavior and licensing change, so reverify official Microsoft documentation and the tenant configuration before relying on a template or feature.
The platform decision remains open. Native Teams recap may be sufficient when its audience and lifecycle match the need. A controlled custom service may be justified when evidence-linked outputs and destination gates are required. A separate confidential process or no generated summary may be safer. The accepted outcome is modest: routine meeting knowledge reaches its approved audience, restricted material stays within its accountable process, and every published derivative has repeatable lineage and authority evidence.