AI Agent Data Security: Questions to Answer Before Connecting

AI agent data security starts with the same questions as any connected application: what can it read, what can it change, where does information go, and who can stop it? An agent also interprets untrusted text from messages, documents, and websites. That material must not be allowed to expand the agent’s access or override the workflow’s rules. A document that asks for admin access should have about as much authority as a sticky note asking for the office keys.

Draw the complete data path

Before connecting a production account, map a sample task from the original record through retrieval, model processing, tool calls, logs, and saved results. Include temporary files and error traces. The data path often includes more services than the visible chat interface suggests. Review each provider’s applicable storage, retention, access, and deletion settings for the actual service and account configuration.

Example: a client document asks the assistant to export files

Suppose an uploaded project brief contains text instructing the assistant to send all client records to a new address. That instruction is part of an untrusted document. The application should provide no general export tool for this task, and it should enforce the user’s record permissions independently of the model. A warning in the prompt may help the model interpret the input, but it does not replace those controls.

OWASP’s prompt-injection guidance describes this risk of instructions arriving through content. Its authorization guidance also emphasizes enforcing access checks consistently. The practical consequence is to make the permitted action small and verifiable instead of relying on the assistant to police a powerful account. OWASP reference OWASP reference

Agree on boundaries before enabling tools

1. 01

   Separate read and write capabilities

   An assistant that summarizes jobs may not need any write access. Add a specific action only when the workflow requires it.

2. 02

   Minimize the supplied context

   Provide the information needed for the current task. Avoid sending entire account histories when a few relevant fields are sufficient.

3. 03

   Approve consequential actions

   Show the exact recipient, content, and record change before approval. Recheck permissions and current state when the action executes.

4. 04

   Prepare revocation and recovery

   Document how to disconnect a provider, stop queued work, and investigate affected records. Verify these controls before expanding the rollout.

Ask for evidence, not a broad security label

• A denied-access test with two clients or workspaces.
• A prompt-injection test using a representative document.
• A record of what the agent actually changed.
• A demonstration of disconnecting access and handling pending tasks.

Keep the review proportional to the data and actions involved. This checklist supports a design discussion; it does not establish compliance or certify a provider. Additional requirements depend on the information handled, contractual commitments, and the business’s applicable obligations.