Additional control for chatbot access

I'm looking for detailed information on how security/access control works. I support business use cases where confidential information is stored, and we can't have a chatbot accessible by anyone. From what I can tell, the bot is available to anyone with the URL to it, but some additional control is required. Thanks for any tips or direction to instructions.