📅 The Invite Nobody Thought to Close October 5, 2026 · https://tavi-blog.github.io/the-invite-nobody-thought-to-close/

A recurring meeting invite at a hospital kept working for more than a year after one of the physicians on it left the job. Nobody removed him from the group, and he'd been listed under his personal email instead of the one the hospital had set up for him, against the hospital's own policy, from the start. Last fall he installed a meeting notetaker on his own device and pointed it at his calendar. The next recurring meeting it found was still that one. It joined, transcribed a discussion of seven patients in real clinical detail, and automatically emailed the summary and a link to the full transcript to every one of the sixty-five people still sitting in that invite, several of whom, like him, hadn't worked at the hospital in over a year. The hospital self-reported. The provincial privacy regulator opened a file. Most of the coverage since has landed on one phrase: shadow AI, an unapproved tool slipping past a hospital's defenses.

That framing earns its place, and I don't want to wave it off just because I'm about to argue past it. A free notetaker with no business associate agreement behind it is a real exposure, not a technicality, and the bot's behavior here was the actual mechanism of harm. A dormant calendar invite with a stale account on it is inert. It doesn't do anything on its own. What turned it into a breach was a tool that could join a meeting uninvited by any human in the room, listen the whole way through, and take the initiative to email a transcript to a list nobody had looked at in a year, all without asking anyone first. That's a capability that didn't exist the last time this exact kind of stale access sat around for this long, and anyone writing about this as a new category of risk is pointing at something real.

But I spend a decent share of my working hours in the less interesting layer underneath that story, the access lists, shared project sites, and service queues that keep a large hospital network's day-to-day systems running, and from that angle the regulator's own account of what went wrong reads differently than the shadow AI framing suggests. The tool wasn't approved, and that mattered. It also wasn't the first failure. The first failure was that nobody owned the task of removing a departed employee from a recurring invite, and the second was that his personal email had been sitting in a hospital system in violation of policy without anyone flagging it, for the same length of time. Both of those gaps predate the notetaker by however long he'd already been gone. The tool didn't create the hole. It just happened to be the first thing that walked through it and did something visible on the other side.

That distinction matters because of where the fix is landing. The response to a story like this is almost always a tighter AI acceptable-use policy, a vetted list of approved vendors, a training module on what counts as an unauthorized tool. All of that is reasonable, and none of it touches the actual thing that let this happen, which is that offboarding a person from every list they were ever added to is a task nobody fully owns anywhere I've seen it work, because it isn't one task. It's dozens of small ones scattered across calendars, distribution groups, shared drives, and systems that were each set up by a different person at a different time for a different reason, and closing all of them out requires someone to remember every one exists.

What stays with me isn't the notetaker, and it isn't even the regulator's file. It's that the fix nobody's proposing out loud is the boring one: a checklist tied to an HR departure date that actually gets worked, every time, for every list a name was ever added to, whether or not anyone expects an AI tool to go looking for the gap. That checklist was never going to make it into a vendor policy, because it isn't about vendors. It's about whether anyone in the building still thinks of "remove this person from everything" as a single job that's finished, rather than a dozen separate ones that are each somebody else's problem until a tool smart enough to notice comes along and proves otherwise.