Security and access controls for AI. What the agent can see, you decide. What it did, you can read.

The problem

An AI agent is only as safe as the access it has, and most get more than the job needs. When one answers from a file nobody meant to share, the fault is the permissions, not the model.

What goes wrong

1. 01The agent is connected to everything. A service account with admin rights reads the whole drive, so a question from the sales floor gets answered from the board folder.
2. 02The data goes somewhere nobody wrote down. Working copies sit in a vendor's account, a consumer AI tool, or a laptop, and no one can say what was sent to which model.
3. 03Nobody can audit it. There is no log of who asked what, what the agent read, or what it answered, so the first review finds nothing to review.

The approach

1. 01Scope first. The agent gets a service account of its own, and your team shares specific folders and channels with it. Nothing else is in scope, and removing a folder removes it from the agent.
2. 02Hold the keys. Everyone on our side uses a named account with only the access the task needs. Your team can cut off our access in one step.
3. 03Write down where the data goes: which model provider, under what terms, and what we hand over and delete when the engagement ends.
4. 04Log what a reviewer will ask about. Every question, every source the agent read, every answer, and every deploy, searchable by your admin.

When it works

It works when the agent answers only from sources your team chose, a reviewer can trace any answer to its document, and you can cut off our access without calling us.

The agent sees only what you share

The AI security risk to plan for first is not a model leak. It is an over-shared drive. A knowledge agent gets a service account with admin rights, and it now answers from every folder the company owns. The question comes from the trading desk. The answer comes from the compensation folder.

We set it up the other way around. The agent gets a service account of its own. Your team shares specific Drive folders, documents, and Slack or Teams channels with it. Add a folder, the agent learns it. Remove one, it forgets it. If two groups need different answers, they get two agents with two folder lists, not one agent with a rule we hope holds.

What the agent does not get: private drives, inboxes, the admin console, or write access to anything. The Knowledge Agent answers. It does not act.

Where the data goes, in writing

The originals stay in your Google Workspace, Slack, or Teams. The agent keeps a search index of only what you shared. When someone asks a question, the passages that answer it are sent to a model to write the reply. The commercial providers work under API terms that do not use your data for training.

We never move your data into a tool you have not approved, never share it with another client or venture, and never train a model on it without a written agreement that says exactly what and why. At the end of the engagement, we hand over every credential, repository, and dataset, and we delete our copies on request and confirm in writing when it is done. The security page lists what we never do with your data.

You hold the keys

Named people only, no shared logins. Each person gets the access their task needs, and the task is written down before the access is granted. Production changes go through review, and every deploy is logged.

We integrate and operate the AI systems we build: what each agent can reach, what it logs, how it is tested, and who approves its actions. Network security, IAM and endpoint security remain the exclusive responsibility of your team or your MSSP. An MSSP is a managed security service provider.

We deploy and operate directly within your existing security perimeter, implementing NIST AI RMF and SOC 2-aligned controls. If your vendor review has requirements of its own, bring them to the first call. We check them there.

Every question is logged

A lending desk example. An analyst asks the agent what the firm's exception policy is for a bridge loan with a 30-day close. The log records the question, the three documents the agent read, the answer it gave, and the time. Six weeks later, compliance asks why the desk quoted those terms. The answer takes one search, not a meeting. A claims desk at an insurer gets the same trail.

Every question, every source read, every answer, every deploy. Your admin can search it. The Knowledge Agent does not act. If you later add an agent that does, anything that moves money, contacts a customer, or changes production waits for a named person on your team, and that approval goes in the same log.

When it does not work

It does not work if the agent is given everything to save a week. And it does not work if nobody reads the log.

Where to start

If your documents are the first thing to put an agent on, start with the Knowledge Agent. If you are not sure where to start, ask Roo, Webaroo's AI: How do we put an AI agent on our documents without widening access?