InnoAxis | Cybersecurity & AI Governance

Updated September 14, 2026

An employee asks to connect an AI tool to your project folders so it can prepare the weekly status report.

The potential benefit is easy to understand: less time gathering information and more time managing the project.

But approving the request involves more than deciding whether the AI produces a good summary. Which folders will it access? Could it read another project’s confidential bid? Can it send the report, change a record or follow instructions embedded in a subcontractor’s document?

OpenAI released GPT-6 Astra on September 3, 2026. Its documentation describes a model built for complex work involving reasoning, computer use, research and document creation. That makes it relevant to businesses considering more capable administrative workflows. ^[1]

For construction leaders, the practical starting point is a defined workflow – not unrestricted access. Decide what AI may read, what it may change, who approves consequential actions and how you will judge the result.

What changes when AI can take action?

An AI assistant might draft a project update for an employee to review. An agentic workflow can also use connected tools to retrieve information or act in software. ^[2]

The distinction is not simply the model name. The surrounding product, tools, identity and execution environment determine what the system can actually do. OpenAI’s computer-use documentation, for example, describes an environment that executes the model’s requested actions; the model does not independently acquire access to a company’s systems. ^[2]

Nor did computer use begin with Astra. OpenAI identifies several supported capabilities as continuations of those available with the previous model generation. The important development is increasing capability – not the sudden disappearance of existing governance principles. ^[3]

Keep foundational security controls in place. Account management, secure configuration, security updates, backups and incident preparation remain relevant. The Canadian Centre for Cyber Security includes these practices in its baseline guidance for smaller organisations. ^[4]

The additional task is to apply appropriate boundaries to AI-enabled workflows.

Start with one project-reporting workflow

Consider a hypothetical 50-person construction company testing AI-assisted weekly reporting. This is an illustrative pilot design, not an InnoAxis customer case study or a claim of proven results.

The proposed workflow is deliberately narrow: read approved records for one project, identify outstanding items and prepare a draft status report.

Decision	Proposed pilot boundary
Information available	A designated project folder containing approved documents and reports
Output	A draft that identifies its source documents, versions and unresolved questions
Human responsibility	A project manager checks accuracy and completeness before distribution
Excluded actions	Approving payments, changing supplier banking information, modifying contracts or drawings, granting access, or sending external communications

Before selecting the tool, decide what a successful report must contain. Does it identify the current document version? Distinguish a proposed change from an approved change? Flag missing information instead of filling the gap with an assumption?

Those requirements become the pilot’s acceptance criteria.

This approach also makes it easier to evaluate alternatives. Compare an improved manual process, conventional workflow automation and AI-assisted reporting against the same criteria: quality, total effort, cost and consequence of error.

The most capable model is not automatically the best business choice.

Review the identity – not just the employee's access

Do not assume that every AI integration operates with exactly the same permissions as the employee using it.

Microsoft Graph illustrates the distinction. A delegated integration acts on behalf of a signed-in user within the permissions granted to the application and that user. An application-permission integration can operate through its own identity without a signed-in user. ^[5]

Ask the person implementing the workflow to identify the account or application involved, the documents it can access and the actions it can perform.

For the reporting pilot, access to unrelated HR files or another project’s tender documents is unnecessary. Resolve those boundaries before connecting the agent – not after the first useful demonstration.

Review browser and desktop access as well as application connections. Because computer-use systems can operate through software interfaces, restricting API integrations alone is not a complete assessment of the available access paths. ^[2]

Treat external documents as information, not authority

A subcontractor document should inform a project report. It should not be able to redefine what the AI is authorised to do.

This matters because of prompt injection: malicious instructions embedded in material an AI processes, such as an email, document or web page. An attacker may try to redirect the system, obtain information or trigger an unintended action. OWASP identifies these external-content attacks as a security concern for AI applications. ^[6]

For example, a malicious attachment could attempt to persuade an agent to send project information to an unrelated recipient. That example is hypothetical, but the underlying attack mechanism is documented. ^[6]

A prompt saying “never share confidential information” is useful guidance. It is not a substitute for technical restrictions.

Enforce permitted actions in the application or connected system. A reporting agent that does not need to send email should not receive a general-purpose sending tool. A consequential operation should require approval outside the model’s own judgment. OWASP specifically recommends downstream authorisation and human approval for high-impact actions. ^[7]

Also control who receives the output. A workflow can expose information through its report even when it cannot modify the original files.

Separate training, retention and data location

“Are we using an enterprise account?” is not a complete data-handling assessment.

OpenAI says it does not train on inputs or outputs from ChatGPT Business, ChatGPT Enterprise or its API by default. Individual-service content may be used for training, with opt-out controls and stated exceptions. Consequently, neither “every personal account trains on company data” nor “only Enterprise avoids training” is accurate. ^[8]

Non-training does not mean zero retention. OpenAI’s API documentation describes separate retention arrangements, and Zero Data Retention requires approval and has limitations involving supported endpoints and capabilities. ^[9]

Data location is another question. OpenAI distinguishes storage at rest from processing location and limits certain residency options to eligible customers. A storage-location commitment should not be treated as a promise that every part of a workflow occurs in the same country. ^[10]

Before providing confidential information, document the applicable training terms, retention settings, storage and processing arrangements, and any third-party services involved.

For personal information, Canadian privacy regulators emphasise that generative AI remains subject to existing privacy frameworks. Their guidance addresses legal authority, appropriate purposes, safeguards and accountability. The obligations for a particular organisation depend on its circumstances; purchasing a subscription does not resolve that assessment. ^[11]

Make human review part of the business case

A fast draft is not the same as a completed business process.

For the pilot, measure the time required to prepare inputs, review the report, correct errors and handle exceptions. Include software and implementation costs. Record whether the output misses important items or creates additional work for project managers.

Set the acceptance criteria before the pilot, rather than adjusting them to justify the tool afterward.

A useful decision rule is:

Expand only when the workflow demonstrates acceptable quality and a defensible benefit after review, correction and operating costs.

Risk management should continue after the first successful test. NIST’s Generative AI Profile supports incorporating trustworthiness into the design, use and evaluation of AI systems rather than treating evaluation as a one-time activity. ^[12]

If the review burden outweighs the benefit, simplify the workflow, reduce its scope or choose another approach.

A practical first 90 days

The following is a planning sequence, not a guarantee that a workflow will be ready for wider deployment within 90 days.

Days 1-30: establish the boundaries

Identify the AI tools already being used and the business problems employees are trying to solve. Give staff a clear route to request an approved tool rather than relying only on prohibitions.

Select one workflow and assign a business owner. Review the relevant account terms and information-handling requirements. Correct the permissions for the data being connected, define permitted outputs and document excluded actions.

Use synthetic or otherwise appropriately minimised information when real personal information is unnecessary. Canadian privacy regulators recommend considering these alternatives and evaluating whether a proposed use is necessary and proportionate. ^[11]

Organisation-wide document cleanup may continue separately. What should not wait is control over the pilot’s own information and access.

Days 31-60: test normal work and failure conditions

Run a limited pilot with a small group.

Include missing documents, conflicting versions, incorrect inputs and attempts to manipulate the workflow. Test whether approval requirements and access restrictions hold when the task cannot be completed as requested.

Keep useful records of actions, approvals and errors, while protecting sensitive information in those records. Establish a way to stop the workflow and revoke its access. OWASP’s agent-security guidance recommends adversarial testing, monitoring, bounded execution and careful handling of sensitive logs. ^[13]

Days 61-90: decide whether expansion is justified

Compare the results with the original process and the acceptance criteria.

Can the owner explain what information was used? Are outputs sufficiently reliable? Is review effort proportionate? Can failures be investigated and the workflow stopped?

Expand only where the results justify it. Otherwise, correct the design, narrow the task or discontinue the pilot.

The objective is controlled delegation

A useful AI workflow should have a clear purpose, a defined information boundary, limited authority and an accountable owner.

For a construction business, the first success may be a better weekly reporting process – not an autonomous system connected to every project and financial application.

Start with a workflow whose value can be measured and whose mistakes can be detected before they create a business commitment.

Establish your security baseline before expanding AI access

InnoAxis’s Secure Foundation offering reviews cloud posture, identity, data exposure and governance, then establishes a prioritised roadmap. InnoAxis works alongside an existing IT provider rather than assuming it must replace that team. ^[14]

Book a fit call to discuss the security baseline for your first AI-enabled workflow.

Frequently asked questions

Does GPT-6 Astra automatically gain access to company files?

No. Access depends on the product, connected tools, accounts and permissions involved. The model’s supported capabilities are not, by themselves, permission to access a company’s environment. ^[15]

Is a business subscription enough to make an AI workflow secure?

No. A subscription may provide useful privacy and administrative controls, but those controls vary by offering. The organisation still needs to assess the workflow’s data, permissions, approvals and operating arrangements. ^[10]

What does Astra's "Critical" cybersecurity classification mean?

OpenAI says Astra reached the Critical cybersecurity capability threshold under its Preparedness Framework. It describes assessed capability and the associated need for safeguards. It is not a statement that every use is unsafe, nor a guarantee that a particular deployment is safe. ^[16]