An AI (artificial intelligence) agent is a system that uses a language model to plan and carry out tasks on its own through connected tools, such as email, files or internal systems. Its main risk is permissions: an agent with broad access can leak data or make changes if it receives hidden malicious instructions (prompt injection) or if no one reviews its actions.
How TecnetOne handles it: Microsoft 365
AI agent security, agentic AI risks, autonomous AI agents, AI agent permissions, agentic AI security
Related terms
DPIA (data protection impact assessment)
A DPIA (data protection impact assessment) is an assessment carried out before processing begins that identifies and measures the risks a personal data processing activity poses to people's rights, and defines measures to reduce them. The GDPR (General Data Protection Regulation) requires it in Article 35 when processing is likely to result in high risk, such as large-scale processing of health data.
Privacy by design
Privacy by design is the principle of building personal data protection into a system, process or product from the start, rather than adding it afterward. It means collecting only the data that is needed, making the most private option the default and planning for encryption and retention periods. The European GDPR (General Data Protection Regulation) requires it in Article 25.
Microsoft Purview and sensitivity labels
Microsoft Purview is Microsoft's family of solutions for governing, protecting and managing compliance of an organization's data across Microsoft 365 and other sources. Its sensitivity labels classify documents and emails, for example as Confidential, and apply encryption or access restrictions that travel with the file. Microsoft 365 Copilot honors those labels and permissions when it generates responses.
Data minimization
Data minimization is the privacy principle that an organization should collect and keep only the personal data that is adequate, relevant and limited to what is necessary for a stated purpose. For example, a quote request form does not need a contact's date of birth. The GDPR (General Data Protection Regulation) includes it, and applying it reduces the impact of a potential data breach.
Data residency and sovereignty
Data residency is the geographic location where an organization's data is stored and processed, such as the cloud region it selects. Data sovereignty is the principle that this data is subject to the laws of the country where it is located. A financial institution may require both by regulation or by contract, and it should verify where its cloud provider actually stores its data.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.