Before allowing a personal AI agent to work with company information, approve a specific task, the information it may use, and the actions it may take. Begin with a limited pilot that produces something a person can review. Add permission to send messages, change records, or make purchases only when the business needs that authority and the application can enforce the agreed limits.
A November 6, 2026 joint advisory from Singapore's Cyber Security Agency, GovTech, and IMDA addresses personal AI agents that can act through connected applications and accounts. Its consumer guidance also tells people to check employer permission before connecting work accounts. For an IT manager, the immediate decision is what that workplace permission should cover.
Turn a useful task into a bounded pilot
Consider a hypothetical distributor whose purchasing coordinator wants an agent to compare supplier quotations. The useful result is a comparison of prices, delivery dates, and exclusions. Selecting a supplier, sending a reply, and placing an order are later business decisions.
For the first trial, the IT manager could approve the following scope. This is a proposed design to validate with the agent provider and system owners, not a claim that every product offers these controls.
Inputs: Use synthetic quotations in a dedicated pilot workspace. Give the agent access only to those inputs and a separate output location. Keep the coordinator's ordinary email, purchasing system, shared drives, and signed-in browser sessions outside the pilot.
Work: Extract the quotation details and produce a comparison for the coordinator. Provide only the tools required to read the inputs and create the output. Leave general command execution, arbitrary web requests, account connectors, and new add-ons unavailable to the agent.
Decision: The coordinator checks the comparison against the source quotations. Supplier communications and purchase approval remain in the existing human workflow.
The endpoint or agent-platform administrator must establish the actual isolation and file permissions. Naming a folder in a prompt does not create an access restriction. If the application requires broader tools or access than this task needs, choose a more constrained workflow or postpone the pilot.
A locally installed agent may still send selected content to a cloud model. The Singapore advisory highlights this processing and storage question. Identify the provider, account, processing arrangements, and retention before introducing real quotations. Define the network connections required for that approved processing and keep the agent's general browsing and upload tools disabled for this trial. Synthetic inputs let the team evaluate usefulness before entrusting supplier information to the service.
Understand how a document can redirect an agent
Suppose a quotation contains text telling the agent to retrieve the distributor's confidential price list and send it to an outside address. That text is part of a document being analyzed. It is not an instruction from the purchasing coordinator.
If a vulnerable agent treats the text as a command and has access to both the price list and a sending tool, it could disclose the file. This is an illustrative prompt-injection scenario: outside content influences the agent's behavior. It is not a reported incident at the hypothetical distributor.
OWASP's guidance on excessive agency identifies unnecessary tools, excessive permissions, and excessive autonomy as separate causes of harmful actions. It recommends removing unneeded functions and enforcing authorization in the systems that execute requests.
In the proposed pilot, the confidential price list is inaccessible and no mail-sending connection is provided. Those choices remove the particular path described above. The agent could still produce an inaccurate or manipulated comparison, so the coordinator must verify the output before using it. Limiting actions and checking the recommendation solve different parts of the problem.
Use application control to govern what runs locally
The pilot also needs an approved software boundary. An agent may arrive with an installer, local runtime, helpers, or optional add-ons. Review the components required for the task before allowing them to execute on a work device.
Through its White Cloud Security partnership, Network Box USA provides application allowlisting and zero-trust malware prevention for covered Windows and Linux endpoints. The service uses centrally managed trust policies for applications, libraries, and scripts, with execution logging. Applied to an agreed deployment, that control can restrict unapproved local software and give the operator evidence of allowed or blocked execution.
Bring the proposed agent and its required components into that review. Confirm compatibility, enforcement mode, and how approved runtimes and helper processes are treated. An approved interpreter may still run many commands; tool restrictions need separate enforcement. Execution policy also does not decide which cloud records the agent may read or change. Those permissions remain with the agent platform and business-system owners.
Keep additions and updates in the same review process. Our application allowlisting and software-update guide explains how changed components affect execution trust.
Treat sending a supplier reply as a separate expansion
After a useful pilot, the coordinator may ask the agent to send clarification emails. That request adds external communication authority. Define the allowed recipients and sending account, and show the complete message and attachments for approval before delivery.
OWASP's AI Agent Security Cheat Sheet recommends tying approval to the exact action and checking it outside the model's decision process. In this example, approval of a question to Supplier A should not authorize a different recipient or an added attachment. A changed proposal needs another review.
Test that behavior with controlled recipients and synthetic documents before expanding access. If the product cannot enforce the required boundary, retain manual sending. The business can still benefit from a prepared draft without granting delivery authority.
Before accepting either stage, establish how to stop the agent, remove its access, and retain useful activity records. The Singapore advisory recommends revoking access in both the agent and connected accounts. Removing access does not recall information already sent or reverse a completed order.
To discuss the endpoint-control part of an AI pilot, contact our team with the proposed software, operating systems, required components, and business task. Bring a description of the intended data and permissions; keep confidential quotations and credentials out of the form.