Connecting an assistant to real company data takes about five minutes, which is exactly the problem. The install is trivial. The decision underneath it is a permissions decision, and most teams make it by accident. Here are the four questions worth answering first.
MCP (Model Context Protocol) is the open standard that lets an AI tool call outside systems, and it is the right foundation to build on: one protocol, every assistant, no vendor holding your context. The risk is not the protocol. It is how fast servers get stood up on top of it. Trend Micro found 492 MCP servers reachable on the public internet with no client authentication in July 2025, and counted 1,467 by April 2026. A Censys scan in June 2026 found 12,520 internet-reachable MCP services, most of them unauthenticated. An academic measurement study of real remote servers put roughly 40 percent of them at zero authentication on their tool interfaces.
Read those numbers the right way. They are not an argument against giving AI access to your work. They are evidence that the default posture is open, and that the safety of your particular setup is something you choose rather than something you inherit.
The answer should be a list of folders, not the word "everything". All-or-nothing access is the most common real weakness, because it turns one bad instruction into a full disclosure. Ask for per-file or per-folder grants, and ask specifically whether a broad rule written for the team silently includes the agents. It should not.
Each agent should be its own identity holding its own credential, never a shared team key. Then switching one off is a single act with an obvious blast radius: that agent stops, everything else carries on. If killing one assistant means rotating a secret five other things depend on, nobody will ever do it.
Most tools show you writes, because writes are visible in the content anyway. Reads are the ones that matter for a confidentiality question, and they are usually invisible. "What did this agent look at last month" should have an answer before you connect it to anything sensitive.
Ask where the data sits, whose data sits beside it, and what export looks like on your worst day. If export is a support ticket rather than a button, the honest answer is that you cannot take it back.
Access control fails in practice because nobody reads it. A permission model expressed as a configuration blob or a grid of checkboxes is technically precise and humanly opaque, so it gets set once, by whoever happened to be configuring things that week, and is never audited again.
The test worth holding any tool to is whether a non-technical owner can read the access rules out loud and tell you whether they are right. If a rule needs an engineer to interpret, it will be wrong eventually and nobody will notice.
An agent should never inherit access from a rule written for people. If a wildcard for the team silently includes the AI, the permission model is decorative.
Instructions hidden inside content. An agent that reads a document is reading text somebody else wrote, and text can contain instructions. This is the reason an agent's limits have to be enforced outside the model rather than requested politely inside the prompt. If your only protection against a rogue instruction is that the model was told to ignore it, you do not have a protection.
Permissions that outlive their reason. Access granted for one project on one afternoon tends to survive for years, quietly widening what a compromise would cost. The fix is unglamorous: grants narrow enough to be worth revoking, and a list short enough that reviewing the whole thing takes a minute.
None of this makes the AI correct. An agent with flawless permissions can still file a confident wrong number, and no access model catches that. What good structure buys you is the ability to see it, attribute it, and undo it, which is a different and far more achievable goal than preventing it. Aim for accountable, not infallible.
Memava is built around those four answers: per-file rules written as plain sentences that bind people and agents alike, one identity and one revocable credential per agent, reads on the record beside writes, and plain markdown you can export at any time. The security page has the posture in full, and the developer page has the endpoint shape.
Keep reading: One memory across Claude, Cursor and ChatGPT · Own your knowledge base: why plain files win · What is a team second brain?