Should AI have the same data access restrictions as employees?

To get the most out of generative and agentic AI systems, enterprises are giving them broad access to business data. This process, however, is not simply a matter of opening the data floodgates and letting AI do its thing; it raises some very important governance questions that CIOs need to address. For instance, if an employee does not have permission to open a particular document, should they be able to obtain its contents by asking an AI tool?