Configuring Read AI Calendar Rules and Sharing Permissions to Protect Sensitive Meetings

Deploying AI meeting assistants across an enterprise promises substantial productivity gains, but unmanaged rollouts frequently trigger privacy incidents. When employees connect Read AI to their Google Workspace or Microsoft 365 calendars, the assistant defaults to aggressive auto-joining and broad recap distribution. Without intentional administrative controls, Read AI bots will routinely enter sensitive one-on-one reviews, executive strategy sessions, disciplinary hearings, and board discussions—subsequently emailing full transcripts, sentiment analyses, and action items to attendee lists or shared channels.

Securing your organization requires a defense-in-depth model across the Read AI Workspace, individual calendar configurations, and corporate identity providers. The following guide provides actionable configurations for IT administrators and department heads to prevent unauthorized bot attendance and secure post-meeting data.

The Root Problem: Why Read AI Joins Sensitive Meetings

To establish effective controls, administrators must understand how Read AI operates under default settings:

1. The "Private Event" Myth: Marking a meeting as "Private" in Google Calendar or Microsoft Outlook does not stop Read AI from joining. Once a user grants OAuth calendar permissions, Read AI parses any calendar entry containing a supported video conference link (Zoom, Microsoft Teams, Google Meet) and schedules the bot to join.
2. Universal Auto-Join Defaults: By default, Read AI enables auto-join for all calendar events where the user is an attendee, not merely meetings they organize.
3. Attendee-Driven Infiltration: If an HR manager turns off Read AI on their account, but an employee participating in the performance evaluation still has Read AI active, the employee's bot will enter the meeting on their behalf.
4. Automated Recap Broadcasting: After the call, Read AI automatically generates summaries, action items, and coaching metrics, distributing them via email or connected Slack channels to attendees and workspace members based on default access tiers.

Layer 1: Read AI Workspace Administrative Controls

Enterprise IT administrators with Owner or Admin privileges in Read AI should enforce baseline policies at the organization level before onboarding teams.

1. Centralized Auto-Join Policies

Navigate to the bottom-left corner of the Read AI dashboard, select Workspace Settings, and open the Settings tab:

• Default Auto-Join State: Change the organization-wide baseline from joining all events to either disabled by default (requiring explicit user opt-in) or restricted to Only meetings you host.
• Attendee Filtering: Restrict auto-join rules to Internal meetings only (matching your corporate email domain). This immediately prevents the bot from joining external legal, vendor negotiation, or customer calls without deliberate manual invites.
• Disable Ad-Hoc Meeting Auto-Join: Turn off the toggle for unscheduled or ad-hoc meetings on Zoom and Google Meet to prevent surprise bot appearances during spontaneous confidential discussions.

2. Report Sharing and Recap Distribution Defaults

In the same Settings tab, configure the data distribution pipeline:

• Default Access Tier: Set default report access for both internal and external participants to No access or Host only. Attendees will not automatically receive a link to the transcript unless the host explicitly grants permission.
• Notification Broadcasting: Disable automatic post-meeting recap emails to participant lists. Require summaries to be distributed manually or pushed only to personal user dashboards.
• Team Channel Integrations: Restrict automated Slack or Microsoft Teams channel posting. Ensure sensitive teams (HR, Legal, People Operations, Finance) are excluded from shared workspace folder syndication.

3. Role Permissions and Access Boundaries

Switch to the Permissions tab in Workspace Settings:

• Audit "Global Report Access": Under Advanced Permissions, ensure Global Report Access is disabled or strictly limited to compliance officers. When enabled, admins can view and edit every meeting report owned by any workspace member, creating internal privacy conflicts for confidential HR records.
• Role-Based Feature Governance: Set clear boundaries for Users, Managers, and Admins. Prevent standard users from modifying organizational sharing baselines.

Layer 2: Pre-Meeting Calendar and Host Safeguards

Even with strict workspace defaults, individual hosts and sensitive departments require granular controls on a per-meeting basis.

1. The Critical Lever: "Make Report Private"

Read AI provides a dedicated privacy lock that stops bot hijacking by other participants:

1. Open the Read AI Calendar page.
2. Locate the upcoming sensitive meeting (e.g., Annual Review, Compensation Sync).
3. Click the Access button next to the meeting title.
4. Toggle on Make report private.

Why this setting is vital: Enabling "Make report private" sets participant access to "None" and prevents other participants from adding Read AI to that session. Even if an employee attending the meeting has auto-join enabled on their personal Read AI account, their bot will be blocked from attaching to the meeting.

2. Per-Meeting Auto-Join Overrides

On the Read AI Calendar page:

• Review upcoming meetings and toggle the Add Read? switch to Off for specific meetings or recurring calendar series.
• Apply toggles at least five minutes before the scheduled start time to guarantee synchronization across Read AI's scheduling service.

3. Personal Account Recording Preferences

Instruct managers and sensitive team personnel to verify their personal configurations:

• Go to Account Settings > Meeting Recording > Auto-Join Preferences.
• Set Which Calendar Events to Only meetings you are hosting.
• Set Who's Invited to Internal meetings only.
• Under Account Settings > Report Sharing, verify that default distribution is set to Only me.

Layer 3: Perimeter Defense via Identity and Platform Governance

Corporate IT administrators must use Google Workspace, Microsoft Entra, and meeting platform admin centers to enforce technical boundaries that cannot be circumvented by end-user settings.

1. Google Workspace Admin Console

If your enterprise utilizes Google Workspace:

• Navigate to Security > Access and data control > API controls > App access control.
• Search for Read AI under Accessed Apps.
• Set the application access status to Blocked for sensitive Organizational Units (such as Human Resources, Legal, and Executive Leadership).
• Alternatively, restrict calendar OAuth scopes so that third-party applications cannot read calendar event metadata without administrative whitelisting.

2. Microsoft 365 and Microsoft Entra ID

If your enterprise uses Microsoft 365 and Microsoft Teams:

• Entra ID Enterprise Applications: In the Microsoft Entra admin center, navigate to Enterprise applications > Consent and permissions. Restrict user consent for third-party apps requesting calendar read scopes (Calendars.Read, Calendars.ReadWrite). Require admin approval for all OAuth consent requests.
• Teams Admin Center: Go to Teams apps > Manage apps, locate Read AI, and set its status to Blocked or assign an app permission policy that excludes departments handling confidential communications.
• OAuth Grant Revocation: Review existing OAuth grants and revoke active refresh tokens for former employees or unapproved organizational units.

3. Meeting Room Perimeter Controls (Zoom, Teams, Meet)

The physical meeting room must remain defensible during live calls:

• Enforce Waiting Rooms / Meeting Lobbies: Configure Zoom and Teams security policies to send unverified external participants and automated bots to the waiting room. Meeting hosts can inspect the attendee roster and admit only human participants.
• In-Meeting Eviction: If a bot enters unexpectedly, the host or co-host can immediately remove the bot via the participant panel. In Zoom and Teams, removing a participant blocks them from re-entering the active session.
• Disable Ad-Hoc Bot Recording: Configure platform policies to require explicit host authorization before third-party recording services can capture audio streams.

Administrator Configuration Reference Table

Incident Response: Handling Accidental Recordings

If a Read AI bot enters a confidential meeting and records sensitive discussion, follow this remediation sequence immediately:

1. Expel the Bot: Remove the Read AI assistant from the participant list during the meeting to stop ongoing recording.
2. Lock Down the Report: The meeting owner must immediately open the Read AI dashboard, find the newly generated report, click Share, and set internal and external access to No access. Remove any generated public links.
3. Purge the Report: From the report options menu, select Delete Report to permanently remove transcripts, audio extracts, and summaries from Read AI servers.
4. Submit a Data Deletion Request: If highly sensitive personal identification information (PII) or protected employee health data was captured, an administrator should submit an account-level data erasure ticket through the Read AI Account & Privacy Center.

References

• Read Help Center - Managing Auto-Join Preferences and Calendar Sync
• Read Help Center - Workspace Settings and Admin Permissions
• Google Workspace Admin Help - Control which third-party & internal apps access Google Workspace data
• Microsoft Entra Documentation - Manage user consent and admin consent to applications
• Zoom Support - Using the Waiting Room