When AI can write in Microsoft 365: draw the permission map first

When AI only summarizes an email, a mistake is usually cheap. When the same add-in can change a spreadsheet, archive a thread or prepare an outgoing message, you need to know exactly where the boundary sits.

The problem is that “has access to Microsoft 365” says almost nothing. Reading, drafting, modifying, archiving, deleting and sending are different actions. Each may apply to a selected range, one document, one inbox or an entire account.

An AI permission map is a working document that ties each action to an object, identity, data flow, approval, audit trail and recovery path. Draw it before the pilot receives write access.

New Microsoft 365 add-ins make the question concrete

According to xAI's launch page, the Grok add-in for Excel can analyze selected cells, write formulas, create charts and run scenarios. It can also pull context through connectors, including email, SharePoint and Google Drive.

Source: xAI – Grok for Excel

Microsoft Marketplace describes two direct capabilities: the add-in can read and change the document, and it can send data over the internet. That is enough to reject one dangerous shortcut in a review. “Works in the workbook” does not mean local processing with no external data flow.

Source: Microsoft Marketplace – Grok by SpaceXAI for Excel

The Outlook case is even sharper. xAI says Grok can read long threads and attachments, search the web and X, write replies and triage recent mail by archiving finished conversations or marking junk. The vendor also says nothing is sent until the user presses send.

Source: xAI – Grok for Outlook

The Marketplace capability declaration, however, says the add-in can read and modify personal information in the active message and that other mailbox items cannot be read or changed. That is difficult to reconcile with the broader inbox-triage description. There may be a technical explanation, but an administrator should not guess it. Require the actual add-in or OAuth manifest and test the behavior in the tenant and plan you intend to use.

Source: Microsoft Marketplace – Grok by SpaceXAI for Outlook

Start with the action, not the product name

Create one row for every action the pilot needs. Do not collapse them into a single box called “write access.”

• Read: see cells, messages, attachments, calendar entries or files.
• Draft: propose a formula, reply, meeting or document without committing it.
• Modify: write to cells, edit recipients, move an object or update metadata.
• Commit: send, archive, delete, book, share or change a permission.

A sensible first step may allow reading and drafting while blocking commit actions. If there is no useful result at that level, broader authority is premature.

Complete nine fields for every AI action

Copy the following fields into a working document. Each row should describe one action against a defined type of object.

1. Action

Use a verb that can be tested: “write a formula in selected cells,” “create a reply as a draft” or “archive a message.” Avoid vague descriptions such as “help in Outlook.”

2. Object and scope

State what the action may touch: a selected cell range, a named workbook, the active email thread, a specific SharePoint site or a test calendar. Also list what is out of scope: other sheets, hidden columns, shared mailboxes, private folders and new recipients.

3. Effective identity

Record the account that actually performs the action and the permissions it already holds. An add-in running through an owner's account may inherit far more authority than the pilot needs, even if the add-in itself appears narrowly scoped.

4. Data leaving Microsoft 365

Document which data is sent out, to which provider and through which domains. Separate prompts, document content, attachments, metadata, search queries, tool results and telemetry. “Not used for training” and “not retained” do not answer what is transmitted during the run.

Google describes the same split from another angle in Gemini Enterprise. Allowed connector data sources and allowed egress domains are separate policies, and whether they are enforced depends on the project configuration. Connection and outbound traffic need their own controls.

Source: Google Cloud – managed policy constraints for Gemini Enterprise connectors

5. Approver

Name the role allowed to approve the integration and the role allowed to approve the individual action. They do not have to be the same person. A Microsoft 365 administrator may approve the add-in while a finance owner approves changes to a forecast workbook.

6. Human gate

Write down what the user must see before an action is committed: proposed change, old and new values, recipients, attachments, number of affected objects and a plain description of the consequence. “Are you sure?” without context is not a useful gate.

7. Deny test

Every row needs at least one test that should fail. Try to read an excluded sheet, change a locked cell, open another mailbox, add a new external recipient or archive a message outside the test folder. A successful happy-path run does not prove the boundary.

Gemini Enterprise shows why connector filters must follow the action. In July, Google announced that Jira Data Center filters in preview apply to both search and action execution; out-of-scope retrievals or mutations should fail or return no result. Test the user's authority and the connector filter anyway. One does not replace the other.

Source: Google Cloud – Gemini Enterprise release notes, July 15, 2026

8. Audit trail and recovery

Decide what evidence must exist after a run: account, time, object, action, approver, before-and-after value and denied attempt. For Excel, recovery may be a version checkpoint and reviewed diff. For Outlook, you need to know how archived or moved test messages are found again. Deletion should normally remain outside the first pilot.

9. Pilot metric and stop rule

Measure something that can support a decision: time saved per reviewed workbook, share of drafts accepted without major revision or number of correctly triaged test messages. Write the stop rule in advance as well. Unexpected data transfer, access to the wrong object, an unaudited change or bypass of a human gate should pause the pilot immediately.

Two small tests reveal more than one large demo

Excel: selected range versus the rest of the workbook

Create a copy with invented figures, several sheets and a clearly marked test area. First have the AI explain a variance, then write a formula inside the allowed range. Deliberately try to make it modify another sheet. Inspect network destinations, version history and the actual diff — not just the chart it produced.

Outlook: draft versus inbox triage

Use a test mailbox with harmless messages and unique markers. Ask the AI to summarize an active thread and create a reply as a draft. Confirm that sending requires a person. Then test separately whether the tool can read, move, archive or delete messages beyond the active item. When product copy and the capability declaration point in different directions, this test is a requirement, not a detail.

Copy this permission map

Complete one block per action:

• Workflow and owner:
• Exact action:
• Allowed object and scope:
• Explicitly forbidden objects:
• Account and effective identity:
• Data sent out and destination:
• Administrative approver:
• Commit-time approver:
• What the person sees before approval:
• Deny test and expected failure:
• Audit evidence:
• Recovery path:
• Pilot metric:
• Stop rule:
• Decision date for expansion or retirement:

The map is complete only when a colleague can read it and predict both what the AI is allowed to do and what happens when it tries to cross the boundary.

If the add-in manifest, data flow or write gates remain unclear, do not begin with a broad tenant deployment. Take one workflow through Tool Forge and build a test that demonstrates the allowed action, the denied case and the recovery path.