Access to data isn't enough - the data itself has to be trusted. In the OP the user had access to the google doc as it was shared with them but that doc isn't

Access to data isn't enough - the data itself has to be trusted. In the OP the user had access to the google doc as it was shared with them but that doc isn't trusted because they didn't write it. Other examples could include a user uploading a PDF or document that came that includes content from an external source. Anytime a product injects data into prompts automatically is at risk of that data containing a malicious prompt. So there needs to be trusted input, limited scope in the output action, and in some cases user review of the output before an action is taken place. Trouble is that it's hard to evaluate when an input is trusted.