--- title: "AI security: the scope of an agent — G&G Technologies" description: "AI agent security: a defined scope of action, access limited to what is needed and human approval. A review of the AI tools already in use." publisher: "G&G Technologies" lang: en canonical: https://ggtechnologies.sm/en/services/ai-security/ translation: https://ggtechnologies.sm/servizi/ai-sicurezza/index.md --- # An agent does what it is allowed to do. *AI for security* An AI agent reads data and instructions as the same text. The scope of its actions, the access it holds and the cases that need a confirmation are decided at design time. - [Talk to us](mailto:info@ggtechnologies.sm?subject=Information%20request) Or write to us: [info@ggtechnologies.sm](mailto:info@ggtechnologies.sm) - **1997** the first project - **18** years in manufacturing - **900** workers in the study *The starting point* ## The risk is not the model. It is what the model can reach. A language model does not separate the data it reads from the instructions it receives: they are the same text. A document, an email or a web page can therefore carry a request that the agent carries out as though it came from you. It is called prompt injection, and it is why an agent is designed starting from its powers. The method is the one used for any application that touches company data: which actions it may take, on which systems, with which credentials, and when a person has to approve. The choice of model comes afterwards, and it can be changed. #### A public case **CVE-2025-32711** has a date, two severity scores and an address where anyone can read it. [The article that tells it](https://ggtechnologies.sm/en/insights/autonomous-agents-boundaries/). #### Rules The GDPR and the AI Act for processing and for the duties on high-risk systems; for offences and civil liability connected with AI, Italian Legislative Decree 160/2026. #### The people Whoever uses the tools learns to spot a request that should not be carried out: [professional use of AI](https://ggtechnologies.sm/en/training/professional-ai-use/). #### Development Software designed and developed entirely in Europe. *The proof · a public identifier* ### We asked the hard question in the open. In 2025 a vulnerability in an AI assistant connected to company documents was given a public identifier, **CVE-2025-32711**: a request hidden inside a document got the assistant to hand over data the author of that document could never have read. We wrote it up at length, with the date, the severity scores and the sources at the foot of the page. It is a case anyone can check without coming through us. [Read the article](https://ggtechnologies.sm/en/insights/autonomous-agents-boundaries/). It proves one thing, and it is the thing that matters before signing: the reasoning about where an agent's boundary falls has been done, and it is written down. *What we build* ## Four decisions that bound what an agent is able to do. If the data cannot leave the company, that is another chapter: [how on-premise AI works](https://ggtechnologies.sm/en/services/on-premise-ai/). For the people who will use the tools there are the [training courses](https://ggtechnologies.sm/en/training/). ### The scope of action Every agent has a closed list of operations available to it: anything outside that list goes through a person. - The tools on hand are declared one by one - Sensitive operations ask for a confirmation - Every action leaves a record you can read ### Access limited to what is needed Credentials that belong to the agent, carrying the permissions of the task it has to do and nothing more. - One account per agent, separate from the people's - Read-only where reading is enough - Immediate revocation, without touching the other systems ### Where the processing happens Where the model runs is a design decision, and it changes who answers for the data the agent reads. - Models on your own servers when the data stays in - Personal data masked in hybrid architectures - [On-premise AI](https://ggtechnologies.sm/en/services/on-premise-ai/) ### A review of what is already running Assistants and automations wired to email, files or the management system, read through one by one. - Which data each tool can reach - Where a person's approval is missing - A list of fixes, most serious first *How we work* ## The boundary first, the model second. Never the other way round. 01 ### List the actions Which operations the agent performs on its own, and which stay with a person. 02 ### Grant the access Dedicated credentials and minimum permissions for every system the agent touches. 03 ### Try the abuses Documents and messages built to push the agent off course, before it goes live. 04 ### Keep the record A log of the actions, a periodic review and quick revocation when something changes. *FAQ* ## Frequently asked questions ### What is prompt injection? It is a request hidden inside a document, a message or a web page, which the agent reads and carries out as though it came from you. The defence lies in the powers: if the agent cannot issue a payment or delete an archive, a hidden request gets nothing. ### Can I connect an assistant to the company mailbox? Yes, and it is an architecture decision rather than a setting: which folders it reads, what it may send, which messages need a confirmation. The difference between a trial and a live service lies in those answers. ### I already use AI tools bought elsewhere: can you review them? Yes. The review lists, for each tool, which data it reaches, which actions it takes on its own and where a person's approval is missing. What comes out is a list of fixes, most serious first, with the work each one takes. ### Is a local model enough to make an agent safe? No, and the two answer different questions. A local model decides where the data is processed; the boundary decides what the agent may do. An agent running on your own servers can still write into your systems. ### How do I know what the agent did? From the log: every action leaves the time, the operation and the data it touched. It is also how you measure whether it is doing the job it was put there for. *Insights* ## Technical analysis on the same subject. ### [Before you hand an AI agent the keys](https://ggtechnologies.sm/en/insights/autonomous-agents-boundaries/) To an AI agent, the content it reads and the instructions it receives are the same text: that is prompt injection. Three questions to ask first. ### [The AI Act and client data](https://ggtechnologies.sm/en/insights/ai-act-client-data/) What a firm using AI on client data actually risks, between the AI Act, the GDPR and Italian Law 132/2025, and what to do from Monday morning. ## Where to go next ### [Artificial Intelligence](https://ggtechnologies.sm/en/services/artificial-intelligence/) Agents that read documents and query your systems, with the measure agreed first. ### [On-premise AI](https://ggtechnologies.sm/en/services/on-premise-ai/) How to choose between fully local, hybrid and cloud, starting from your data. ### [Training](https://ggtechnologies.sm/en/training/) Practical four-hour courses on artificial intelligence, for companies and professionals. ## Do you have an AI agent wired into your systems? Tell us what it does today and what it can reach. From there we can see where a boundary is needed and where a confirmation is. - [Email us](mailto:info@ggtechnologies.sm?subject=AI%20agent%20security) - [Call us](tel:+3780549900824)