The Meeting Room and Access Checklist

01 What your tools show people

According to the criminal complaint, the engineer used a work productivity tool to ask about meeting rooms, calendars and where leadership meetings happen. He didn't break in anywhere. He asked, and the tool answered. He's charged, not convicted.

In a lot of companies, room calendars, meeting titles and who's attending are open to almost everyone, often because nobody changed the default. AI assistants don't create that access. They make it searchable: anything an employee can technically open becomes one plain English question away.

Open your own calendar as a regular employee would. Search your leadership's names and your biggest meeting room. Note what you can see: titles, attendees, times, the room.

Make sensitive meetings private. Most calendar tools let the organiser mark an event private, so others see only "busy".

Use bland titles. "Acquisition talks, big room, every Thursday at 9" is a map all by itself. "Leadership sync" is not.

Check what your AI assistant can read before you roll it out to everyone. Ask it, as a test user, where leadership meets this week. If it answers, so can anyone.

02 Access that matches the job

He was an engineer with no reason to know where leadership meets. Most insider risk isn't a plot: in a 2025 survey by Ponemon, sponsored by the vendor DTEX, 55% of insider incidents came from negligence or mistakes and 25% from malicious insiders. A file shared with the wrong person. An account nobody switched off.

Review access when someone changes roles, not once a year. New job, new access list. Remove what the old role needed.

Count everyone with a badge or a login. Contractors and vendors are insiders too: anyone you've granted access counts.

Find the doors people forget. The IT contractor with admin rights. The agency with your ad accounts. The person who left in the spring and still has a login.

Cut building and account access the same day someone leaves. Every departure, suspicious or not.

03 Know what normal looks like

The device was a thumb-sized board with a microphone and a memory card. It needed power, not a network: any USB port or charger would do. So locking down ports isn't the fix. Knowing your rooms is. What found it was a sweep, a search for hidden devices that security teams call technical surveillance countermeasures, or TSCM.

Look before the meetings that really matter. Someone takes two minutes to check what's plugged in, under the table and behind the screens.

Give people an easy way to speak up. "There's a gadget here I don't recognise", or "someone keeps hanging around a room they don't use".

Pay for a professional sweep only where it counts. The room where you discuss a sale, a lawsuit or a big deal, before that meeting. For the rest of the office, the habit of looking does most of the work.

04 When you suspect someone

OpenAI didn't confront him. It says it narrowed his access step by step, then suspended it, put him on leave, took his laptop and timed the firing with the FBI. For a normal business, in order:

Don't play detective. No confrontation, no questions in the hallway. Keep what you have. Logs, photos, the device itself. Don't wipe or move anything. Restrict access quietly. Narrow it first, then cut it, without tipping anyone off. Call your lawyer and HR. They decide what happens next, and when. Don't set up your own cameras or recorders without legal advice. Recording people the wrong way is exactly the kind of thing he's charged with.

Before your next leadership meeting. Open the calendar, check who can see it, and take one look behind the screen in that room.

The device cost twenty-four dollars. The access was free.

Sources

The San Francisco Standard: OpenAI engineer arrested over alleged bugging of executive conference room CBS News: FBI arrests OpenAI employee for allegedly planting recording device Gizmodo: How OpenAI says it used AI in the investigation CISA: Defining insider threats DTEX: 2025 Ponemon Cost of Insider Risks report

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.