Data governance, before the connection
You would never hand a new employee access to the entire company drive on their first morning. The connection to your document library is not the risky part. Doing it before anyone has established provenance, governance, and access controls is. This is the five-pass audit PSV runs with CRE firms first, published in full.
Before an assistant reads thousands of a firm's files, three things have to be true: it knows which folders it is allowed to open, it knows which document is the source of truth, and someone has decided what it may draft versus what requires a named person's approval. The audit that establishes those three runs in five passes over the same document estate: inventory, classification, provenance, governance, and security and monitoring. It takes about two weeks at a firm of fifty, and it is re-run on a cadence rather than passed once. Firms that skip it do not get a company brain. They get a confident system quoting last quarter's rent roll out of a folder nobody owns.
Why this comes first
A well-known CRE firm asked us on a call this month whether it should give an assistant access to all of its files to build a company brain. Our co-founder, an engineer who spent time at Goldman Sachs, answered before anyone else could. You would never do that with a person. The question is why anyone would do it with a system that reads faster and asks fewer questions.
Point the assistant at everything, see what happens, tighten it up once something goes wrong. The problem is what goes wrong is rarely dramatic. It is a memo built on a superseded model, a number that was right last quarter, an answer nobody can trace back. Those do not announce themselves.
Spend two weeks establishing who owns what, which document is current, and who signs off. Then connect one folder set and grade it against work you have already finished. Slower for a fortnight, and the only version that is still standing in a year.
Connecting an assistant to a document library, a cloud drive, or a file share is not the problem, and the payoff from a grounded setup is real. Our guide to connecting Claude to CRE data covers what changes once it works. This page covers what has to be true first.
The framework
Each pass asks a different question of the same documents. A firm that skips one does not get four fifths of the result. It gets a system that is confidently wrong in exactly the way that pass was there to prevent.
What exists, and who owns it?
List every repository that holds firm documents. The document library, the cloud drives, the deal folder on the file server, the shared inbox, the folder the property management exports land in, and the personal drives everyone knows are load-bearing. One row each: system, named owner, roughly how many files, what kind of documents, and who has access today.
The finding that turns up every time is a repository with no owner, and a permission group nobody has reviewed since the person it was built around left.
What may be read, and what never?
Four tiers, not a taxonomy nobody will maintain. Open: templates, published research, marketing material, closed-deal files. Working: live deal folders, models, correspondence, scoped per deal or per fund. Restricted: LP agreements and side letters, personnel files, privileged legal correspondence, anything under negotiation. Never: banking and wire instructions, credentials, tax identifiers, and anything carrying a confidentiality obligation that names who may see it.
Write the rule as deny by default and allow by folder. The inverse, allow by default and exclude by rule, fails silently the first week somebody creates a folder nobody thought to exclude.
Which document is the source of truth?
For every recurring document type, name three things: the system of record, the version and naming rule, and how old is too old. Rent roll, T-12, operating budget, the model, lease abstracts, the org chart, the current LOI. Then move superseded copies out of the readable path. If a document cannot be dated or versioned, it does not go into the readable path yet.
A person picks the current rent roll out of habit. An assistant has no such habit, and quotes the stale one with the same confidence as the current one.
What can it draft, and what needs a person?
Three bands. Draft freely: summaries, abstractions, first passes, internal comparisons, anything a person will read before it matters. Draft and route: memos, LP-facing commentary, anything with a number that will be relied on, anything leaving the firm. Never: sending, signing, committing, pricing, or anything that creates an obligation. Put a person's name against every gate in the middle band, not a role.
Nothing the system produces becomes firm knowledge on its own. A person approves it first, and the approval is recorded with the work rather than in somebody's inbox.
Can you prove it after it is on?
Scope the access at the connector, not in the prompt, because an instruction is a preference and a permission is a control. Log every read and write: what ran, what it read, what it produced. Test revocation before you need it, and time how long it actually takes. Confirm in writing that nothing you provide trains a public or shared model, and set the cadence to re-run passes 01 through 03.
The audit is a standing control, not a gate you pass once. Folders multiply, people move, and a permission list is accurate for about a quarter.
| The pass | What you decide | What it prevents |
|---|---|---|
| 01 · Inventory | Every repository holding firm documents, with a named owner and the current access list. | An assistant reading a shared drive nobody owns, governed by a permission group built for someone who has left. |
| 02 · Classification | Four tiers, written as deny by default and allow by folder. | Restricted material reaching the readable path because the exclusion list did not anticipate a new folder. |
| 03 · Provenance | The system of record, version rule, and staleness limit for each recurring document type. | A confident answer built on last quarter's rent roll, indistinguishable from one built on this quarter's. |
| 04 · Governance | Three approval bands, with a named person against every gate in the middle band. | Output that nobody owns leaving the firm, and observations becoming firm knowledge without review. |
| 05 · Security and monitoring | Connector-level scoping, a read and write log, tested revocation, and the re-run cadence. | A control that was true at launch quietly stopping being true a quarter later. |
Findings that mean stop
Not risks, findings. Each one is something a person can check this afternoon and either find or not. Any one of them is a reason to finish the audit before the first connection is made.
If nobody owns it, nobody can say what belongs in it, and nobody will notice when something that should not be there appears.
Stale access is the most common real finding in a CRE estate, and it becomes materially worse the moment a system starts reading at machine speed.
The assistant will pick one. Without a version rule, which one it picks is effectively arbitrary, and the answer will not show its work unless it is asked to.
This is usually an artifact of a migration rather than a decision. It has been survivable because people do not browse each other's folders. A connected assistant does.
If the answer is a role rather than a person, or a committee rather than a name, the gate does not exist yet. Write the name down before the first connection, not after the first incident.
The order matters more than the pace. Everything below happens before the first connection is turned on.
Name an owner for every repository. Pull the current access list for each one and read it out loud in a room with the people who would notice a wrong name on it. Sort folders into the four tiers, and write the allow list rather than the exclusion list.
Name the system of record and the version rule for each recurring document type. Archive the superseded copies out of the readable path. Set the three approval bands and put a person's name against every gate.
Connect the smallest tier-one folder set and run it on work your team has already finished, where you know what the right answer was. Grade the output against the outcome you already know. That is the only honest test of whether the first four passes were done properly.
This is an operating framework, not legal or compliance advice. Where a document carries a confidentiality obligation to a counterparty, a regulator, or a limited partner, the firm's counsel decides what may be read, and this audit is the inventory that makes that a short conversation rather than a long one.
Free data & security assessment
Twelve questions about your own document estate, scored against the five passes of the CRE AI data and security audit. You get a scorecard, the pass to start on, and the specific findings to go and look for.
12 questions · About 5 minutes
If your estate is already in good shape, the assessment says so and tells you to keep it that way. That is the point of it.
Frequently asked
Why the Company Brain matters here
Passes one through three get the estate into a state where a system can read it safely. That is necessary, and it is not the same as your firm having a position. Which comp set counts, which assumption survived the last committee, which of two conflicting documents the firm actually stands behind: none of that is in a folder, and none of it arrives with a connector. It is the layer PSV builds on top of a clean estate, and it is the reason the audit is the start of the work rather than the whole of it.
The firm has an answer to what is current, and it is not the newest file.
What counts as the current rent roll, the current comp set, or the current house assumption becomes something the firm has decided and recorded, rather than something re-derived by whoever opened the folder last. A stale document in a drive stops being able to become a confident answer.
Approval is a step in the work, not a habit people are asked to keep.
The gate between a draft and a firm position sits inside the system, with a name against it and a record left behind. Nobody has to remember to be careful, which is the only version of careful that survives a busy quarter.
What the firm knows outlives the folder structure it was stored in.
Drives get migrated, teams reorganize, and folder conventions change with whoever set them up. The approved knowledge does not have to be re-audited every time, because it stopped depending on where a file happened to sit.
Where to go next
Score your own estate against the five passes above and the assessment names the one to start on, in about five minutes. PSV also runs this audit with firms directly, and writes the memo your own reviewers will read.
The other half
Security and data architecture
Where PSV-built systems run, the control plane and data plane split, and the six controls your reviewers can check.
The connection itself
Claude MCP for CRE
What a connection actually does once the audit is clean, and the order a CRE shop should connect things in.
What it is for
The Company Brain
What a firm gets once its own approved knowledge, rather than its folder structure, is what the system reads.
Governance notes · PSV newsletter
The findings that turn up in a real CRE document estate, the folders that should never have been readable, and the approval gates that held once volume arrived. Written for the person who has to sign off. Free, and one click to leave.
No spam. Unsubscribe in one click.
Next step
Twelve questions about your own document estate, scored against the five passes above. You get a scorecard, the pass to start on, and the findings to go and look for.