iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Audit the running agent, not just its index. Before an AI agent can summarize or search a workspace, document the intended files, inspect every discovery route, test the deployed identity, and prove both allowed and denied retrievals. An index exclusion may stop semantic search while a direct file read, text search, connector, or inherited conversation context still exposes data. The reliable result is an evidence record showing exactly which identity can retrieve which resource, through which tool, under which boundary.
What a workspace read-set audit actually establishes
A read-set audit answers a narrower and more useful question than “is the folder private?” It establishes what the deployed agent can discover or retrieve at the moment of testing, using the identity and tools it will use in production. Treat these as separate surfaces:
- Workspace context: directory structure, symbols and definitions, selected or visible editor text, conversation history, and previous tool results can all become context.
- Semantic indexing: an index may pre-process eligible text files so the agent can find relevant passages.
- Text, grep, and file search: a search result can enter the conversation even when the agent never opens the matching file.
- Direct reads: a tool may open a path by name or by a path discovered from directory metadata, independently of the semantic index.
- Connected data sources: repository, document, ticket, or storage connectors have their own scopes and authorization checks.
- Retrieval identity: an application identity, a dedicated agent identity, or a signed-in user’s delegated identity can produce different results.
The audit is complete only when each applicable route has a positive test for approved material and a negative test for restricted material. “Not indexed” is not equivalent to “not readable.”
1. Write the intended scope before changing settings
Start with a one-page scope statement that another administrator could execute without guessing. Record:
#1 Best Overall
- the task (for example, “summarize release notes in repository A”);
- the workspace, collection, tenant, repositories, sites, or folders in scope;
- file classes the task needs, such as Markdown documentation or source code;
- data that must be excluded, including credentials, private keys, customer records, production logs, generated artifacts, and unrelated large datasets;
- the agent owner, business sponsor, approver, operating environment, and intended audience;
- every tool the agent may call, including search, file-read, repository, and connector tools; and
- whether access is read-only and whether any write or action capability is genuinely required.
Microsoft’s governance guidance recommends documenting purpose, approved data, tool dependencies, and the operating environment. Use that record as the acceptance criteria for the tests below; do not broaden access merely because a tool makes configuration easier.
2. Map every discovery path
Make an inventory of the surfaces through which the agent could learn a filename, path, snippet, or document. For each surface, name the configuration that controls it and the identity that enforces it.
| Surface | What to inspect | Evidence to capture |
|---|---|---|
| Semantic index | Included file types, project boundary, indexing status, and exclusions | Index status, configuration export, and a query for an approved fixture |
| Text search or grep | Ignore and search-exclude rules, search roots, and result permissions | Positive and negative query results, including filenames and snippets |
| Explorer and directory listing | Hidden files, folder visibility, and directory metadata returned to the agent | Listing output and whether restricted names appear |
| Direct file read | Path-based read tools, symlink behavior, archive extraction, and inherited OS permissions | Attempts against an approved file and a restricted fixture |
| Conversation context | Selected editor text, visible tabs, prior tool results, and copied content | A clean-session test showing what context is present before the task |
| Connectors | Repository, storage, document, or ticket scopes; action constraints; tenant boundaries | Connector configuration and request/response audit records |
Do not infer one surface from another. A file absent from an index can still appear in a directory listing, search result, selected editor buffer, connector response, or direct read.
Recommended Free Tools
3. Inspect VS Code workspace controls independently
In Visual Studio Code agent workflows, current documentation describes context assembled from indexable workspace files, directory structure, symbols and definitions, selected or visible editor text, conversation history, and previous tool results. A text-search or grep match returned to the agent becomes conversation context even if the matching file is never opened. Semantic indexing covers relevant text files in the current project; common file types may be skipped, and binary files such as images or PDFs are not indexed.
Review these three settings separately because they have different effects:
| Setting or file | Text search and grep | Semantic indexing | Explorer visibility |
|---|---|---|---|
.gitignore |
Excluded | Excluded | Not necessarily hidden |
files.exclude |
Excluded | Excluded | Hidden |
search.exclude |
Excluded | Not excluded by this setting | Visible |
Inspect repository-level and user-level settings, then confirm which one wins for the deployed workspace. A setting that hides a file from Explorer does not prove that a path-based tool cannot open it. Conversely, a search exclusion does not remove content that was already selected, pasted into chat, or returned by another tool.
When semantic indexing is unavailable, the agent may fall back to text search, grep, file search, or language intelligence. Therefore, an index health check is only one test in the audit. Run the same restricted fixture through each fallback that the agent can invoke.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Verify the identity that will retrieve data
Sign in as the deployed identity, or obtain an administrator-generated test token for it. Testing with the builder’s account is insufficient. Record the identity type, tenant, roles, group memberships, service principals, delegated grants, and downstream permissions.
Dedicated or application identity
An application permission can run without an active user context and may reach organizational data within its granted scope. Review both direct grants and permissions inherited through groups, roles, managed identities, or connector registrations. Remove broad permissions that the task does not need.
User-delegated identity
Delegated access runs in the signed-in user’s context. Test with a least-privileged representative user, then repeat with any elevated role that could be used in production. A successful test by an administrator can hide failures—or excessive access—for ordinary users.
Agent and human separation
AWS’s Agentic AI Lens recommends strong authentication for agent identities, separation of agent and human permissions, least privilege with dynamic boundaries, and regular access reviews. Apply the same separation when the agent runs inside an editor or automation service: the person approving a task should not silently lend the agent their entire personal access set.
5. Run a positive-and-negative retrieval test
Create fixtures whose contents are unmistakable and non-sensitive. For example, place APPROVED_READSET_MARKER in an in-scope documentation file and RESTRICTED_READSET_MARKER in a credential-like file outside the approved scope. Never use a real secret as a test value.
- Start clean. Open a new agent conversation, close unrelated editor tabs, clear previous tool results where the platform permits, and note the exact workspace or collection selected.
- Test semantic retrieval. Ask for the approved marker and record the file, passage, identity, and tool call. Ask for the restricted marker and require the agent to state that it cannot retrieve it; a refusal without a recorded authorization check is not proof.
- Test text search and grep. Search for each marker by exact string and by a distinctive filename. Confirm that restricted filenames and snippets do not enter the conversation.
- Test directory and file search. Ask for a listing of the relevant folder and for the path of the restricted fixture. Check whether names, sizes, or metadata leak even when content is blocked.
- Test direct reads. Request the approved path, then the restricted path, including alternate spellings, relative paths, symlinks, and archive members if those tools exist. Capture the authorization decision and returned status.
- Test connectors. Run the same pair of requests against every connected repository, document store, or ticket system. Verify tenant, site, repository, and collection boundaries in the request and response.
- Repeat as the real audience. If users can invoke the agent with their own sessions, repeat the tests for a normal user, a user lacking the repository permission, and any approved service account.
This matrix is an operational recommendation derived from the documented differences among indexing, search, direct reads, connectors, and identity permissions. Keep the exact prompts, timestamps, tool names, response status, and correlation IDs with the audit record.
6. Treat connector constraints as usage rules, not data filters
ChatGPT Workspace Agents can have apps or connectors configured, and Connector Action Constraints can narrow how an action is used. OpenAI’s documentation explicitly states that these constraints do not filter or restrict the data a connector returns. Inspect the connector’s underlying authorization and response payload, not only the action-constraint screen.
If an agent is published with personal connections, users may be able to access data or perform actions through the creator’s connection. Use least privilege, limit the audience, avoid sensitive or high-impact connectors unless necessary, and audit the published configuration. A connector that can read an entire site is not safely scoped merely because the agent prompt asks it to summarize one folder.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
7. Check authorization and data boundaries on every retrieval
For workspace summarization, Microsoft recommends a task-based, read-only role scoped to the workspace or collection, restricted to approved repositories and sites:
“Grant a task-based (read-only in this case) role scoped to the workspace or collection (resource boundary) and restrict to approved repositories and sites.”
Use resource boundaries, sensitivity labels, tenant restrictions, and downstream authorization together. Microsoft’s guidance says authorization should be verified on every retrieval call, because an earlier approval or a broad session token can outlive the context in which it was granted. Deny unreviewed tools and cross-tenant or guest paths by default.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Log the evidence and prove revocation
An audit that cannot be reproduced is only a configuration screenshot. Store one record per test with:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- agent name and version, owner, sponsor, and approver;
- purpose, approved data scope, resource boundary, and excluded classes;
- identity type and identifier, tenant, roles, groups, and delegated or application grants;
- tool, connector, repository or site, requested action, path or query, and returned data classification;
- timestamp, environment, result, denial reason, and correlation ID; and
- configuration snapshots for index rules, search rules, connector scopes, and permission assignments.
Use the Microsoft 365 administration center’s agent-permission and activity-related security views where applicable. Confirm that normal retrievals and denied attempts appear in logs with enough detail to attribute the action.
Best Value
Revocation drill
- Disable the agent or its account and verify that a new retrieval fails.
- Rotate or remove its credential and confirm that old sessions or tokens cannot continue retrieving data.
- Invalidate delegated tokens where the platform supports token revocation.
- Remove a test repository permission or connector grant, then repeat the negative test.
- Check for stale identities, cached indexes, scheduled jobs, and copied outputs that remain after access removal.
Record the observed time to denial and any residual data separately; revocation of future access does not automatically erase content already delivered into a conversation, log, cache, or export.
9. Choose an implementation pattern deliberately
| Decision axis | Lower-risk default | Higher-risk alternative to justify | Audit question |
|---|---|---|---|
| Resource boundary | One workspace or collection with named repositories and sites | Organization-wide or cross-tenant scope | Can the agent enumerate resources outside the task? |
| Identity | Dedicated agent identity | User-delegated or creator’s personal connection | Whose permissions appear in the retrieval log? |
| Permission mode | Read-only task role | Write, share, delete, or execute actions | What business step requires each elevated action? |
| Exclusions | Validated separately for index, search, direct read, and connector paths | One global ignore rule treated as universal | Did a restricted fixture fail on every available route? |
| Data boundary | Sensitivity labels, tenant limits, approved repositories, and per-call authorization | Prompt-only instructions such as “ignore confidential files” | What technical control enforces the boundary? |
| Traceability | Detailed activity logs with correlation IDs | Manual screenshots or incomplete application logs | Can an investigator reconstruct a single retrieval? |
| Lifecycle | Scheduled reviews and tested revocation | Review only after an incident | What event triggers the next assessment? |
10. Troubleshoot common audit failures
The agent finds a file marked “excluded”
Identify the route first. If the result came from grep, inspect .gitignore and search.exclude; if it came from Explorer or a direct read, inspect files.exclude, OS permissions, symlinks, and path-based tools. Then repeat the test in a clean conversation to rule out previously supplied context.
The agent cannot find an approved file
Check whether its type is skipped by semantic indexing, whether the file is outside the current project, and whether a search rule excludes it. Test text search and a direct read separately. If a fallback tool is required, document that dependency rather than weakening exclusions globally.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A connector returns more data than the action description suggests
Inspect the raw response and connector authorization. Action constraints govern how an action is used; they do not necessarily filter returned records. Narrow the connector’s underlying repository, site, tenant, or identity scope, then rerun the negative fixture.
Revocation appears delayed
Check token lifetime, cached index contents, queued jobs, scheduled automations, and copied conversation outputs. Test a fresh session after credential rotation and token invalidation, and record which artifacts remain available.
11. Re-review after material change
Repeat the audit whenever the workflow, tools, data scope, identity, connector, repository layout, indexing behavior, or deployment environment changes. Also re-review after a role or group-membership change, a new cross-tenant connection, a major editor or agent update, or an incident involving unexpected context. Keep the previous and new evidence sets so reviewers can see whether the effective read set expanded, narrowed, or merely changed routes.
The practical sign-off is simple: a named owner can show the approved scope, the deployed identity, a passing retrieval for allowed data, a failed retrieval for each restricted class on every available path, complete logs, and a successful revocation drill. Without all five, the workspace is not ready for agent indexing.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
