AI agent security for firms that hold client data

AI agent security is the set of controls that decide what an AI agent may read, change, delete or send in your systems, and who answers for each action. A chatbot only answers; an agent calls tools, so it can update a client record, attach a document, delete a duplicate or email a client. The guides that lead the search results (Pillar Security, Promptfoo, Illumio, read October 2026) are written for security teams; for a 5 to 50 person firm, the question is narrower. You need no security operations center for this. Before the agent touches a household file, you need five answers. Whose permissions does it use? Which actions wait for a person? Where does the trace of its work sit? What does the model provider do with the text it reads? Where are the files hosted? The OWASP AI Agent Security Cheat Sheet puts the approval rule in one line: “Require explicit approval for high-impact or irreversible actions.” Standards serves as the worked case for each of the five answers, on a firm's client records.

An AI agent on client records carries six risks, because it can read a household, change a contract, delete a file or email a client. The six: access wider than its user's, instructions hidden in an email or PDF, an irreversible delete or send, changes nobody can trace, client details reused to train a model, and files stored where your clients did not agree. The table pairs each risk with the control that limits it.

No vendor can promise that an agent will never follow an instruction planted in a document, the attack called prompt injection. Illumio's guide recommends a check on what the agent reads: validate inputs and retrieved data before the agent acts on them, since instructions hide in emails, documents and web pages (read October 2026). That check lowers the odds without removing them. You control how far a fooled agent can reach. An agent that can only reach one person's records, and must ask before anything leaves the firm, can be fooled without the damage spreading.

Standards decides an agent's access by intersection: the agent acts with its own role, agent_default unless you assign another, cut down to the roles of the person it works for. That person is whoever sent the message, ran the routine, or last turned on or edited the trigger or schedule that started it, as the security and hosting documentation states. A tool call outside that person's access is refused; the agent reads the refusal and carries on with what it may do. For a firm, this means an agent started by a junior adviser cannot open the partners' private households, even when the agent itself could. You avoid the shared account that Illumio's guide to agentic AI security warns about (read October 2026), because the agent never holds more than the human beside it. Security teams call this zero trust applied to agents: no access beyond the person it acts for, and every call checked again against that person's rights. A record you may not see looks missing, so neither you nor the agent can tell a private file from one that does not exist.

Roles carry the detail. A role grants read, create, update and delete object by object, and the built-in owner and member roles cannot be edited: for narrower access you build a custom role, as roles and permissions explains. Nobody grants what they do not hold, so a team lead cannot hand an agent rights the lead lacks.

External assistants such as Claude Code, Codex or Cursor follow the same rule in Standards: their access never exceeds their credential's. When you connect one to the workspace, it sees up to eight tools, and only those its credential can use. A tool your key cannot use is absent from its list, and Standards checks each call again against the record it touches (MCP tools). A read-only key leaves the assistant with no write tool at all. A personal key narrows the moment you demote its owner, and stops when you suspend them.

By default, a Standards agent waits for a person before it deletes a record or sends anything outside the firm, and the approval card counts what the action would touch, so you see how many records go before you click. Standards sorts each agent tool by risk: reading, changing your data, deleting, and sending something outside the firm. Edits depend on the mode you pick in the conversation, and a new conversation starts in Auto. In Manual mode, the agent “asks for your approval before each change to your data”. In Auto mode, it “changes your data without asking”, and deletions and sends still stop for you. A routine, and any sub-agent an agent starts, runs in Auto with the same exception. The table shows each action by mode, under the default policy:

Email has a stricter rule. When an agent sends a message, it asks first whatever the conversation's mode or the agent's own policy. The card shows the sender, every recipient with bcc included, the subject, the attachments and the text that will leave, and it flags any recipient who was not part of the thread, as the agents documentation describes.

Standards records an agent's writes under the agent's own name, with the person it acted for beside it. The activity feed reads like “Intake agent for Dana”, a fictional example: you see the agent's name next to the person who answers for the work. Each audit entry written during an agent's turn carries the id of the conversation, and the agent's name links back to that conversation or routine when you can open it, per the records documentation. On each record, the history shows who changed what and when, colleague or agent, with the value before the change, so you can put back a beneficiary or an address an agent got wrong. Reading that history is itself a permission: an agent acting for someone without audit access is refused. One limit to plan around: the trail lives on each record. Standards does not offer a single screen listing every change across the workspace today, so a review of an agent's week starts from its conversations and routines.

No, with two exceptions. Standards asks the Vercel AI Gateway to exclude every provider that trains on prompts, on each model call its own agents make, fallbacks included (Vercel's prompt-training filter). You choose the model for each agent, and the filter applies to whichever model you pick. If no compliant provider serves that model, the call fails rather than reaching one that trains. The filter covers agent conversations, search embeddings, image generation and transcription. The first exception is live voice dictation: the gateway refuses the filter on streaming transcription, so a client's details you dictate aloud do not carry that guarantee. The second is any model Standards does not call itself. An agent on a Claude Code, Codex or Cursor harness, or one of those assistants connected over MCP, reaches its provider with your own access, under that provider's terms (environments). None of the top guides on AI agent security we read in October 2026 (Pillar Security, Promptfoo and Illumio) says whether the model provider may train on the text the agent sends it. It is still a fair question from a client whose file an agent reads.

In Standards, two other flows carry client text out of the workspace. Mail bodies, history included, go to an embedding provider through the same gateway so you can search mail by meaning, and one setting turns that off. Meeting recordings are processed in the EU by a recording vendor that deletes them after 24 hours, per the security and hosting documentation, read in October 2026.

Your records sit in one of three places, and you pick which: the shared Standards cloud at api.standards.new, a dedicated instance on isolated servers reserved for your organization under your own hostname, or your own infrastructure under a license. Your agents and assistants call the same API and the same MCP tools in all three cases. Each request reaches one workspace, the one its key names, and Standards tags every record with the workspace it belongs to, as security and hosting describes (read in October 2026).

One service sits outside these guarantees: cloud browsers, which let an agent navigate a portal for you, run at a browser provider that gives no data-residency guarantee, even in its EU region. Leave them off for any portal holding client data you must keep in one place.

Securing an AI agent on client records takes four steps before its first conversation and one each week after, shared between the partner, the admin and each adviser. A firm without an IT lead gives the admin steps to the partner who owns the client list.

For the CRM side of the same decision, our AI CRM guide compares what agents do in each kind of tool. Wealth management firms can see how these controls map to household files on the wealth advisers page.