AI agents and confidential data: why instructions are not enough
AI agents and confidential data: why instructions are not enough
Consider a fictional example. A sales manager asks an AI agent to research public information before a client meeting. The agent can also read the client file. To make its search more specific, it includes the client’s name and a confidential negotiation detail in a web query. No email is sent. No document is shared. Yet that information has just left the business.
Permission to browse the Internet is not permission to disclose a client file. Confidentiality instructions help a model respect that distinction. They do not replace controls enforced by its tools and environment over the data it can access, the information it can transmit and the approvals it needs.
A web search can itself disclose information
When a team describes an assistant as “read-only”, it often means the assistant cannot change records. But searching the web involves sending a request to an outside service. If the query includes internal information, that information reaches the service even if the agent only opens public pages afterwards.
The useful question is not just “can it send emails?”. It is “what can its tools send out, and to whom?”. A search, connector or analysis service can carry confidential context without attaching a file. Controls need to cover those exchanges, not merely the visible send buttons.
Our business guide to AI agents explains the distinction between generating an answer and using tools to act. Once tools are involved, the task needs enforceable permissions rather than a broad promise of responsible behaviour.
“Never disclose confidential data” is useful guidance, not a lock
An agent needs clear rules: which files to consult, which information to leave out and when to ask for approval. Without them, an overly specific search may look like a helpful way to complete the task. The mistake is not writing instructions. It is treating those instructions as a security boundary.
Claude Code’s documentation makes this explicit for CLAUDE.md files and automatic memory: they provide context, not enforced configuration. That is a documented distinction for this product, and a useful question for any supplier: if the model proposes an action that breaks the rule, what actually stops it?
A page the agent reads may also contain instructions designed to divert it. This is prompt injection: content that should be treated as information attempts to direct the assistant’s behaviour. An attacker is not required for every leak, however. OpenAI also describes accidental disclosure, where an agent shares more private data with a connected tool than the user expected.
Our article on the AI assistant risk triangle examines the combination of private data, outside content and a route for sending information out. Here, the less obvious point is that the search tool can already provide that route.
Four controls to ask for before connecting client files
1. Access limited to the actual task
Comparing public offers does not require access to the entire sales portfolio. If a summary needs internal context, the agent should only be able to read the documents required for that task. A manager may legitimately work across twenty clients; the agent preparing tomorrow’s meeting does not therefore need access to all twenty files.
2. Checks on both the destination and the data
A domain allowlist narrows the possible destinations. It does not determine what information may be sent to them. An approved search engine is still an outside service: approving it should not permit unrestricted disclosure of contract details.
Ask what is checked before information leaves: the destination, the permitted content and the purpose of the task. If the environment cannot enforce the boundary you need, reduce the information available to the agent or separate public research from confidential analysis.
3. Approval that shows what will leave
For a sensitive action, “allow this tool” is too vague. The reviewer needs to understand which information will be transmitted, who will receive it and why it is needed. Approval must happen before transmission, not after the result arrives. Without those details, the team cannot make an informed decision.
4. Evidence that does not copy the whole file into logs
The team needs to trace the tool used, the destination, the authorisation decision and any refusals. That does not justify copying all confidential content into technical logs. Access to those records and their retention need limits too. The business owner should also know who can suspend the agent if something goes wrong.
Does running the model locally solve this?
Running a model on equipment under your control can avoid sending its context to a remote model provider. It does not close connected tools. A local agent that calls a web service still sends that service a request. Model hosting and control over outgoing information are separate decisions.
Our LM Studio guide to local AI explains what local execution changes. Protecting a client file also requires checking connectors, supporting services and logs rather than assuming that “local” describes the entire workflow.
A closer look: why we favour Hermes Agent for a controlled business deployment
If confidentiality depends on the execution environment, choosing the model that writes the best summary is not enough. At Say Digital, Hermes Agent is a framework we favour when building a business agent whose operation the company can shape. The open-source framework lets you choose where the agent runs and which model provider it uses. Our business guide to Hermes Agent explains the distinction between the model, connected tools and human responsibility.
The point is not to replace a Claude instruction with a Hermes instruction. Claude Code focuses on software development; Hermes can provide an execution layer for business tasks spanning several tools. Their uses overlap, but this is not a security ranking. The practical benefit is the ability to make explicit choices:
- Hosting and model: choose the agent’s environment, then decide separately whether a remote or local model fits the sensitivity of the work.
- Lasting context and procedures: retain useful instructions and reuse “skills”, procedures the team can review, test and revise. That memory is itself potentially sensitive information and needs governance.
- Permissions and evidence: define connected accounts, allowed operations, approvals and the records needed to review actions. Tools and the environment must enforce those controls; a remembered procedure does not enforce them.
The official Hermes Agent repository documents its deployment options, model choice and reusable knowledge mechanisms. These provide an adaptable foundation, not automatic protection: a self-hosted agent may still send context to a remote model or a web search service. Logs should make actions understandable without unnecessarily copying confidential files.
Our analysis of AI agents’ right to act, including Hermes Agent explains the next dependency: every connection remains subject to the service’s permissions. A sensible first pilot is therefore not “Hermes with every client file”. It is one bounded task, limited access and a prohibited transmission that the team can see being blocked.
Ask to see a blocked action, not just a successful summary
Before connecting real files, test the workflow with fictional data. The team should be able to verify that an out-of-scope document remains inaccessible, unauthorised information cannot leave in a query and a sensitive transmission waits for the right approval. Ask what happens when a control cannot reach a decision: uncertainty must not silently become permission.
A successful test is not a permanent certification. Adding a tool, changing a provider or expanding permissions can reopen a route out. Claude Code’s security documentation distinguishes permissions from network isolation. OpenAI likewise warns that safeguards reduce risk without eliminating it.
For this task, the Say Digital Framework requires the prototype to demonstrate the expected refusals before a controlled rollout. Rules and tests then follow changes to the system, while the team measures time saved and approvals required. A demonstration that produces an impressive summary but never shows what it blocks is not enough to justify access to client records.
Want an agent to use your data without giving it unrestricted ways to send it out? Start with one task and the information it actually needs. Talk to Say Digital about defining access, transmissions and the evidence to require before deployment.
Sources and resources
Documentation checked on 24 October 2026. These recommendations provide a decision framework, not a security certification.
