An agent without controls is not an asset. It is exposure.
We have built systems that ran under PCI, under AML obligations, and under financial-institution audit. We bring the same principles to AI agents — not as a layer added at the end, but as a spine every action passes through.
Why this is on the agenda now
Agents no longer just answer questions. They update ERP records, approve workflows, and contact customers.
Leaked data shows up as an error
It appears on screen, gets caught in testing, and is fixed. The failure is visible, so after-the-fact review is enough.
Leaked data enters the answer
Fluently phrased and stated with full confidence. Nobody necessarily notices. That is why control before the fact beats inspection after it.
Israeli Privacy Protection Authority draft guidance on AI systems adds an active oversight duty that reaches board level. Governance stops being an IT topic and becomes a board topic.
Five controls
Each enforced somewhere in the system — never in an instruction to the model.
Permissions and data access
The agent sees exactly what the person operating it is entitled to see — no more.
Preventing data leakage
Filtering on the way in and on the way out. Sensitive data enters no log and leaves in no answer.
A decision log that cannot be erased
Every action recorded — including blocked ones. Who asked, what exactly, on what basis, and who approved.
Human approval for consequential actions
Whoever requests an action does not approve it — the same separation of duties banking has used for decades.
Audit readiness
The ability to produce a decision record and explain it in minutes, not weeks.
What we never let the agent do
We define with you, in advance, the actions that stay in human hands:
A good agent knows when to stop and ask. That is designed, not hoped for.
Questions worth asking any AI vendor
None of these are technical. They test one thing — whether the vendor has shipped to production, or only demoed.
Where exactly are the restrictions enforced?
In code, after the model decides and before the action executes. A good vendor will show you the enforcement point.
"It is in the instructions we give the model." That is a request, not a control — and it can be talked around.
What happens when the system does not know?
It says so and routes to a person, through a defined and measured path.
A system that always answers is a system that will invent one.
What remains ours if we stop working with you?
The code, the documentation, the data, and an internal team that can operate it.
A vague answer about "ongoing support". This is the dependency question — ask it in the first meeting.
