Least-privilege access by design
An agent is software with credentials, so it should follow the same security discipline as any other account: only the access it genuinely needs, nothing more. We scope each agent to specific systems, specific actions, and specific data, so a mistake or misuse has a limited blast radius.
That means read-only where writing is not required, narrow API scopes instead of admin keys, and clear boundaries on what data the agent can even see.
- Scoped credentials and API keys, never broad admin access by default
- Read-only access where the agent does not need to make changes
- Data access limited to what the specific task requires
- Secrets stored in a proper secrets manager, not in prompts or code
- Separate credentials per agent so access can be revoked cleanly
Data handling and audit trails
Knowing what an agent did, and to what data, is as important as controlling what it can do. We log actions and decisions so you have an audit trail, and we design data flows to minimize where sensitive information travels.
Where your requirements call for it, we can favor on-device or in-your-environment processing and be explicit about which third-party model providers are involved and what they receive.
- Audit logs of agent actions and decisions for review and compliance
- Data minimization so the agent only handles what the task needs
- Clarity on which model providers are used and what data they see
- Options to keep processing inside your environment where feasible
- Redaction of sensitive fields before they reach an external model
- A documented plan for revoking access and rotating credentials
More on custom ai agents
Frequently asked questions
Does our data get used to train someone else's AI model?
That depends on which model provider is used and their terms, so we are explicit about it up front. Many enterprise API tiers contractually do not train on your data. We choose providers and settings that match your privacy requirements and tell you exactly what leaves your environment.
What stops the agent from accessing things it shouldn't?
Scoped permissions. The agent gets credentials limited to the specific systems and actions it needs, not a master key. If it only needs to read your knowledge base, it cannot touch your billing system, because it was never given access to it.
Can you keep everything on our own infrastructure?
Much of it, yes, though the language model itself often runs through a provider's API. We can keep your data and processing inside your environment, redact sensitive fields before anything is sent out, and discuss self-hosted model options if your requirements demand it. We will be honest about the tradeoffs of each.