How do you keep an AI assistant from showing employees Costpoint data they can't see?

It is a fair objection, and the right one to raise first: if the assistant can read the labor tables, what stops a program manager from asking it what a colleague is paid? The answer is already inside Costpoint. The work is making sure it survives the trip out.

Costpoint already decides who sees what, in three layers

Deltek's Costpoint 8.2 help (undated; read November 6, 2026) describes three controls that matter most here. An assistant has to honor every one your administrator has set.

The first is application rights. An administrator assigns each user group Read-Only, Full or Deny rights by module, application and result set. It decides which screens and reports you can open.

The second is organization security, which decides whose data you see once a screen is open. Deltek states its purpose in one sentence: "The primary purpose of organizational security is to prevent unauthorized reporting or inquiry on organization data, not to prevent transaction entry." It is optional, and Deltek's implementation page says it is enabled module by module: "The Apply Org Security check box is cleared by default for all modules." It also reaches further than its name: "Organizational security implies project security and employee security."

The third is data suppression, set user by user. The Company Access subtask of Manage Users has checkboxes that suppress labor, cost and price information "when this user opens a screen or prints a report" where it would normally display, and a Social Security number checkbox that, Deltek notes, "does not affect all screens and reports". In Costpoint's reporting models, Deltek's Business Intelligence help (version 8.1) says, with labor suppression enabled "the values in the amount columns will be zero or will not be displayed."

Notice how each layer is written: around a person using Costpoint's own screens and reports.

What did direct labor cost on project 2152.003 last month?

Asked by the project controller. $184,260 on 2,310 hours, across 14 employees.

Source

Costpoint, project labor detail

Run

Today, 6:02 am

Filter

Project 2152.003, last month

Why you can see it

Your user group has Read-Only rights to this report, the project's organization is in your security profile, and labor suppression is off for your user

Asked by the program manager. I can't answer that for you. Labor information is suppressed for your Costpoint user.

Checked

Your Costpoint user settings, before any data was read

Why you can't see it

Labor suppression is on for your user

Who can change that

Your Costpoint administrator, not this assistant

Sample project, people and figures, to show the shape of a permission-aware answer. Both people asked the same question; the difference is their Costpoint settings, checked before any answer was written.

Deltek's documents do not say the same thing about every path

There are several ways to read Costpoint data, each granted by the customer (see Can AI read our Costpoint data without creating a DCAA problem?). Deltek's documents say different things about what each one enforces.

Dela. Deltek's Dela FAQ (undated) says "Dela inherits user organization and security permissions, so users can only ask Dela questions related to the information they already have access to," and gives a salary example: "if I do not have access to salary information based on my Costpoint permission, Dela will not provide me with that information."

Web services. Deltek's Costpoint Integration Overview (March 26, 2026) says "By default, Costpoint users do not have rights to access integration." Once an administrator grants it, the calling user must have "all rights to the underlying applications and result sets to select/update data via the regular Costpoint UI," and the runtime performs "the same steps that would occur if a user performed the same activity using the regular Costpoint user interface." The call is made as a Costpoint user and held to that user's application rights. We found no statement in the guide about organization security on web service results, and its only mention of labor suppression, a return message, concerns updates, so test both.

Business Intelligence. Costpoint's reporting layer has its own switches. The Manage BI Settings screen has Yes or No fields for organization security and project role security in the reporting models, with a note: "If you select No in any of the fields mentioned above, only Model Security is disabled."

Read-only database access. In Deltek's cloud, the ODBC and JDBC guide (March 26, 2026) says "Read-only access to your Costpoint Cloud database is provided by the Hybrid Data Pipeline client driver." Credentials come through a service request, separately for production and non-production. The guide does not say that application rights, organization security or data suppression apply to a query. Read next to help pages that describe those controls by screen and report, the careful assumption is that a database credential returns every row it can reach to whoever holds it. Ask Deltek in writing if you need that confirmed. On premises, where direct database reads are the customer's own decision, we would assume the same.

If that assumption holds, this path is where the problem lives. One account with a chat box in front of it means anyone who can ask can see whatever the account can read.

The model cannot be the guard

The tempting fix is to tell the assistant, in its instructions, not to reveal salaries. The OWASP Top 10 for LLM Applications (2025) explains why that fails: "the system prompt should not be considered a secret, nor should it be used as a security control." The same entry adds: "Critical controls such as privilege separation, authorization bounds checks, and similar must not be delegated to the LLM, either through the system prompt or otherwise." Its entry on excessive agency puts the fix in one line: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not."

A model that has been handed a salary can be talked into repeating it. One that never received it cannot. So the filter sits in front of the model: the assistant asks as the person, never as itself. Each question carries the identity of the employee who asked it, the data is cut down to what that employee's Costpoint rights, organization profile and suppression settings allow, and only then does anything reach the model. How that is built depends on which path your Costpoint offers. That it is enforced outside the model does not.

For contractors handling CUI, this is also the text of the standard. NIST SP 800-171 Rev 2, which NIST has superseded but DoD contracts still cite, reads at 3.1.1: "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)." An assistant is a process acting on behalf of a user. Requirement 3.3.2 covers the record: "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions." One shared account with no record of who asked sits poorly with both. Most Costpoint finance data is not CUI; for it these read as good practice, next to the first criterion of an acceptable accounting system in DFARS 252.242-7006: "A sound internal control environment, accounting framework, and organizational structure."

The export is outside all three layers

Costpoint's controls end where the data leaves Costpoint. A rate analysis exported to Excel and saved to a team site is governed by the sharing on the file, not by application rights or labor suppression. That matters once a document assistant arrives. Microsoft says "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions," which is the right design and also the catch. Its SharePoint guidance for Copilot (undated; the text refers to spring 2024) says the assistant "utilizes all data that a user has access to, which may include broadly shared files that the user is unaware of." A file shared with everyone years ago is now one question away.

So put the permission question to each of the three assistants we compared in Deltek Dela, Copilot or a custom assistant: which does a contractor actually need?

A permission design is a claim until it is tested

Test it with the people it is supposed to refuse. Before rollout, write down the questions that must fail: a program manager asking what a named employee is paid, a user with labor suppression asking for labor dollars. Ask each one signed in as a real user of that kind, and compare the answer with what the Costpoint screen shows the same person. Where the two differ, the assistant is wrong, in either direction.

Then keep it true. People change roles and administrators change profiles; an assistant working from a copy of last quarter's permissions can be wrong by this quarter. And keep the record: who asked, what was asked, which sources answered, what was refused and why. That log turns "we think it respects Costpoint security" into something you can show an auditor, and the rule that requires it belongs in the AI use policy.

Done this way, the assistant adds no new way to see anything. It is a faster route to what each person could already open, and a refusal, with the reason, for everything else. Every answer shows where it came from. No black boxes. The same trace is what keeps the answer honest as well as permitted; see How do we stop an AI assistant from making things up about our contracts?

Common questions

Does Deltek's Dela respect Costpoint security?

Deltek says it does. The Dela FAQ in the Costpoint 8.2 help (undated; read November 6, 2026) says Dela inherits the user's organization and security permissions, so users can only ask about information they already have access to, and that a user without access to salary information will not get it from Dela. The same FAQ says Dela works with organization security. One point to settle with your administrator: the FAQ says Dela is enabled or disabled at the organization level, while the help page for the Dela tab in Configure System Settings lists a subtask to restrict Dela to specific users or user groups. The Deltek pages we read do not say what data an outside AI client connected through the Dela MCP server can reach.

Does read-only ODBC access to Costpoint apply organization security or labor suppression?

Deltek's guide does not say so. The Costpoint Cloud ODBC and JDBC guide dated March 26, 2026 describes read-only access to the Costpoint Cloud database through the Hybrid Data Pipeline driver, with credentials issued through a service request, separate for production and non-production, and an optional IP allow-list. It does not mention application rights, organization security or data suppression. The Costpoint help describes those controls in terms of screens, reports and inquiries. The careful assumption is that a database credential returns every row it can reach, so an assistant on that path has to apply each asker's Costpoint rights itself, before the model sees the data. Ask Deltek in writing if you need the behavior confirmed for your system.

Can we just instruct the AI not to reveal salaries or rates?

No. An instruction is a request, not a control. The OWASP Top 10 for LLM Applications (2025) says the system prompt should not be used as a security control and that authorization checks must not be delegated to the model, and it recommends implementing authorization in downstream systems rather than relying on the model to decide what is allowed. For an assistant on Costpoint data, that means the data is filtered by the asker's own rights before it reaches the model. A model that never received a salary cannot repeat it.

Will Microsoft 365 Copilot show employees Costpoint data?

Not from Costpoint itself, unless an administrator builds a connection. Microsoft says Copilot only surfaces organizational data a user has at least view permission to. The exposure is the export: a rate analysis or payroll report saved from Costpoint to a broadly shared SharePoint site is governed by that site's sharing settings, not by Costpoint's rights, organization security or suppression, and Microsoft's SharePoint guidance notes that Copilot uses all data a user has access to, which may include broadly shared files the user is unaware of. If you connect an outside system through a Copilot connector, each item carries an access control list, and Microsoft warns that granting access to Everyone can lead to oversharing of sensitive content.