update

Author: mrbullwinkle

articles/ai-services/openai/concepts/assistants.md

@@ -43,11 +43,19 @@ We provide a walkthrough of the Assistants playground in our [quickstart guide](
 |**Run** | Activation of an Assistant to begin running based on the contents of the Thread. The Assistant uses its configuration and the Thread’s Messages to perform tasks by calling models and tools. As part of a Run, the Assistant appends Messages to the Thread.|
 |**Run Step** | A detailed list of steps the Assistant took as part of a Run. An Assistant can call tools or create Messages during it’s run. Examining Run Steps allows you to understand how the Assistant is getting to its final results. |
 
+## Assistants data access
+
+Currently, assistants, threads, messages, and files created via the Assistants API are scoped at the Azure OpenAI resource level. Therefore, any person with access ot the resource or API key access is able to read/write assistants, threads, messages, and files.
+
+We strongly recommend the following data access controls:
+
+- Implement authorization. Before performing reads or writes on assistants, threads, messages, and files, ensure that the end-user is authorized to do so.
+- Restrict Azure OpenAI resource and API key access. Carefully consider who has access to Azure OpenAI resources where assistants are being used and associated API keys.
+- Routinely audit which accounts/individuals have access to the Azure OpenAI resource. API keys and resource level access enable a wide range of operations including reading and modifying messages and files.
+- Enable [diagnostic settings](../how-to/monitoring.md#configure-diagnostic-settings) to allow tracking of operations like **List Keys** and **Regenerate Key**.
+
 ## See also
 
 * Learn more about Assistants and [Code Interpreter](../how-to/code-interpreter.md)
 * Learn more about Assistants and [function calling](../how-to/assistant-functions.md)
 * [Azure OpenAI Assistants API samples](https://github.com/Azure-Samples/azureai-samples/tree/main/scenarios/Assistants)
-
-
-