Who sees whose work
Can my staff see each other's work, and can I see theirs?
If your staff will keep their work here, it is worth settling who can read what before they start.
Tell them first that your admins, with full authority over the space, can open everything in it, personal folders included, as can an admin of a space above yours who enters without an account there.
That covers assistant chats, stored secrets and a log of what each person writes, asks or searches through the space's tools, but never sign-in passwords, and the log blanks only passwords and keys it detects.
Colleagues cannot open each other's personal folders, notes included, or other closed areas until an admin gives them access to all or part of a folder, and only an admin can do that. One exception: an assistant acting under an account of its own can read the introduction note that opens each personal folder.
Keep private material out of what every member can read, including each assistant's folder and notes, which any member may also edit unless an admin limits that. Every member can also read the space's shared notes and, unless an admin withdraws that access, its shared tools and guides.
Partial: Choose who is in a conversation before you start. In everyday use no one, admins included, can delete a single message. Everyone in the conversation can read every message, even private file text an assistant quotes, and so can your admins. Some installations may not have shared conversations yet, and older assistant chats stay readable only by their sender and admins, even when continued.
When someone leaves, disable their account in each space where they have one, which stops them at their next step. Re-enabling can revive sign-ins that had not expired, but a password reset closes them permanently. If the person leaving is your only active admin, make someone else an admin first, because AIEUS will not disable the last one.