Part 4 of 7 · Governance Debt
The last post was about access — AI answering questions from documents people could reach but shouldn’t. Assume you fix all of that. Assume every permission is perfect, every “Everyone” grant is gone, and Copilot only ever reads content its user is genuinely entitled to see. You still have a second problem, and it’s the one nobody screenshots because it doesn’t look like a breach. It looks like a correct answer.
Ask your freshly-governed Copilot “What’s our remote-work policy?” and it returns a crisp, confident summary with a citation to a real document in a real library. The catch: the document it cited is the 2019 draft, marked “DRAFT v3 — do not distribute,” which happens to sit two folders over from the 2026 final that HR actually publishes. Copilot didn’t hallucinate. It grounded its answer in your content, faithfully. Your content just contained five versions of the truth, and it picked one.
AI doesn’t know which copy is the real one
A person navigating SharePoint applies a hundred tiny quality signals without noticing: this folder looks abandoned, that filename ends in _FINAL_v2_USE_THIS, this document’s layout is from three rebrands ago, that one’s in the “Archive — do not use” library. We triage stale content constantly and unconsciously, and we’re good at it because we can see the context around a file.
Retrieval-based AI mostly can’t. It maps your content into a semantic index and retrieves what’s most relevant to the question — where relevance is textual and conceptual similarity, not editorial authority. Microsoft’s own semantic indexing documentation is candid about the mechanism: content is vectorized so the system can find “the most similar or relevant data based on the semantic or contextual meaning,” and every accessible, searchable SharePoint document is fair game for grounding. A 2019 draft and a 2026 final about the same policy are extremely similar to each other. That’s precisely what makes them hard to tell apart, and nothing in “similar” encodes “current,” “approved,” or “the one legal actually stands behind.”
So the failure mode isn’t a wrong answer that looks wrong. It’s a wrong answer that looks exactly as authoritative as a right one — same fluent prose, same citation, same confident tone — because the model has no more doubt about the stale source than the fresh one. Garbage in, confident answer out. The confidence is the dangerous part; it’s what makes people stop checking.
ROT was invisible until it started talking
Every content estate accumulates what records managers call ROT — redundant, obsolete, and trivial content. The redundant: the same policy saved into six team sites because six teams each wanted their own copy. The obsolete: the 2019 draft, the reorg-ago org chart, the pricing sheet from two fiscal years back. The trivial: the meeting-notes stub, the empty template, the test upload from a migration nobody cleaned up.
For years this was a storage-and-tidiness concern, easy to defer forever because it never actually hurt. Duplicates were inert. A stale document just sat there; if nobody opened it, it did no harm, and mostly nobody opened it — obscurity kept it quiet, the same friction that kept oversharing quiet in the last post. AI removes that friction here too, but the consequence is different. Oversharing surfaced content to the wrong people. ROT surfaces the wrong content to the right people. The access is legitimate; the answer is just wrong, and delivered with a citation that makes it look researched.
And it compounds in a way a filing cabinet never did. Five copies of a policy aren’t five times the storage and otherwise harmless — they’re five independent chances for the retriever to ground on the wrong one, five documents that must all be updated in lockstep every time the policy changes, and five near-identical vectors crowding the index so the authoritative version has to compete with its own obsolete siblings for relevance. Duplication doesn’t just clutter. It actively dilutes the signal of the version you want to win.
Microsoft frames this as a readiness prerequisite
This isn’t a fringe concern, and it isn’t unique to any one vendor’s assistant — it’s inherent to grounding AI on an un-curated corpus. Microsoft’s Copilot readiness guidance states it plainly in its opening line: Copilot and agents “work best for your organization when your content is up to date and well governed.” The same guidance devotes a whole step to site lifecycle management and archiving so that “Copilot and agentic experiences reference current content,” and points admins at a content-management assessment to find inactive and low-value sites before turning AI loose on them. The broader SharePoint Advanced Management pitch is, in Microsoft’s own words, about managing content sprawl and the content lifecycle — the polite names for ROT. And Microsoft Purview Data Lifecycle Management exists to help you “keep what you need and delete what you don’t.” When the platform vendor builds retention, disposition, archiving, and a readiness assessment aimed squarely at stale and duplicated content, they’re conceding the point: data-quality debt is a governance problem, and AI is what finally sends the invoice.
Where this leaves you
Data-quality debt was always on the books. Like oversharing, it was tolerable only because friction kept it dormant — nobody stumbled onto the 2019 draft, so nobody had to reconcile it against the 2026 final. AI is a retrieval engine pointed at everything at once, and it doesn’t share your instinct for which copy is real. It will find the obsolete one, read it as readily as the current one, and hand it back with the same confidence and the same citation format as the truth.
That’s the second crack. The first was who can reach your content; this one is whether your content is even right. Both are debts the estate accrued quietly and AI made suddenly legible. And both, so far, have been about content — documents that sit still and wait to be asked. The next post is about something that doesn’t sit still: the agents you’ve already built on top of all this, acting on your content, that you can’t currently see.