A knowledge source sets what an agent is allowed to read. In Agent Builder it is one of the four fields that do the real work, next to the name, description and instructions. Sources can be specific files, SharePoint sites, Teams chats or public web pages, depending on your licence. Keep them narrow and intentional rather than adding everything just in case.
Sharing an agent shares only the sources you added, never blanket access to your SharePoint, and the agent still respects the permissions of whoever chats with it. In a Copilot Notebook the sources go further: they are the only thing Copilot answers from. Point a notebook at a shared folder and Copilot picks up to 300 of the most relevant files; add a file directly to guarantee it is used.