Prevent data leakage when using third-party AI agents

Never send raw sensitive records to an external agent. Route every agent request through a central proxy that strips or tokenises names, IDs and account numbers, enforce role-based permissions, log each query with user identity, and require a human to approve any output that will be re-associated with original data.

How to stop sensitive records leaving your systems

Most leaks begin when someone pastes a raw customer record into an external agent for a quick answer. The practical fix is one entry point: route all agent requests through a central proxy that strips or tokenises identifiers, applies role checks, logs the request and flags sensitive outputs for human review.

• Identify where staff paste or upload confidential data into agents.
• Build or adopt a single proxy that sanitises inputs before they leave your network.
• Log every query with a user identity and timestamp.
• Require a human review for outputs that touch personal, financial or contract terms.

Controls that stop exposure versus controls that only look good

Paperwork and vendor vetting are necessary but they don’t change daily behaviour. Controls that stop exposure are technical and local: sanitise inputs at the entry point, limit who can run sensitive queries, and force human approval on outputs that could re-identify people or reveal accounts.

• Effective: central sanitising entry point that preserves context but removes secrets.
• Effective: role-based access so only designated users can issue sensitive queries.
• Theatre: vague contract clauses or one-off training that leave the old quick route available.

Per-process breakdown: where time and exposure add up

Pick one process and map every touchpoint from creation to publication: creation, enrichment, summarisation, storage and sharing. Each touch is an exposure risk; replace manual paste points with a sanitise-and-forward step so agents never receive raw identifiers while outputs remain useful.

• Creation: initial data entry often includes PII that later gets copied into an agent.
• Enrichment: sales paste contact lists into agents to get company insights.
• Storage: unredacted agent outputs saved into shared docs become long-term exposure.

How incidents progress and the early signs to watch

Incidents usually follow a pattern: someone pastes raw data for a quick answer, the agent returns text containing identifiers, that text is copied into a shared document, and later a customer or compliance team surfaces the exposure. Early indicators are unexpected external hostnames in logs or unredacted text in shared files.

• Sequence: ad-hoc paste → agent response saved → shared doc revisited → exposure reported.
• The first human to notice is often the person who receives a customer complaint or audits a shared doc.
• Root cause: process design that makes the quick route easier than the safe route.

Automate the safe parts; keep a human for judgment

Automate sanitisation, routing, logging and token replacement, and keep a human approving outputs that will be re-associated with original records or published. The human reviewer should decide whether the sanitised answer may be linked back to the source or pushed into CRM or shared documents.

• Automate: stripping identifiers, checking for sensitivity keywords, and logging user identity with each request.
• Human: approve any output that mentions personal, financial or contract specifics before it is saved or shared.
• Automate: alerts when a user repeatedly requests data that needs human review to flag retraining opportunities.

Simple weekly checklist to reduce exposure risk

Run a short weekly checklist: scan logs for unknown endpoints or unsanctioned agents, sample five outputs from high-use teams for redaction quality, confirm the proxy still removes the correct fields, and ask one team why they used an external agent recently. These checks catch configuration drift and risky habits early.

• Check logs for unrecognised external endpoints.
• Sample outputs for leftover identifiers.
• Confirm role assignments and remove users who no longer need access.
• Ask one team for a recent example of why they used an external agent and whether a safe internal option would work.

When to bring in a specialist and what they do

Bring a specialist when you cannot map which workflows leak or when query volume makes manual review impossible. A specialist audits workflows, designs a sanitising proxy, configures role-based gates and hands you clear logs so you can see who queried what and when.

• Specialist work: workflow audit, proxy design, logging setup, human-approval gate, operator training.
• Deliverables: a sandboxed proxy, a set of redaction rules, and a weekly log report you can read.

First concrete step to take this week

Pick the single workflow where people most often paste data into an external agent and run a five-day experiment: require all such requests go into a shared ticket, collect the raw prompts, and tally which fields appear. That reveals what to redact and which redaction rules would stop exposure without blocking answers.

If that task uncovers repeated ad-hoc use, schedule a short discovery call so the workflow can be replaced with a sanitising proxy and a human approval gate. For enquiries use contact.