What should security teams check before AI agents get access to company knowledge?

Before AI agents get access to company knowledge, a security team should check eight things: data location, credentials and access scope, copies versus pointers, retention and training use, tenant isolation, deployment options, the audit trail, and controls for prompt injection and excessive agency. The OWASP Top 10 for LLM Applications 2025 lists the last two risks as LLM01 Prompt Injection and LLM06 Excessive Agency, and the Model Context Protocol (MCP) security best practices cover token handling and scope design. Ask every vendor, and your own team, to answer each check in writing before any agent connects.

Which data and access questions come first?

Start with where knowledge goes and whose access the agent uses: these set the blast radius.

1. Data location. Where are memories, embeddings, prompts and logs stored, and which sub-processors see them? For GDPR or the EU AI Act, the rules depend on your country, the data and how the agent uses it; check with your data protection officer.
2. Credentials and scope. Which identity does each agent use? OWASP LLM06 advises acting "in the context of that specific user", with permissions limited "to the minimum necessary". The MCP security best practices say servers "MUST NOT accept any tokens that were not explicitly issued for the MCP server" and flag wildcard scopes.
3. Copies or pointers. Are documents copied into a new store, or read in place through access you already control? Each copy is one more store to secure, retain and delete.
4. Retention and training. How long is each data class kept, and is any of it used to train models?

Which isolation, deployment and audit questions follow?

Next, check how your data is separated from other customers and what you can reconstruct afterwards.

1. Tenant isolation. Is the deployment single-tenant, or partitioned inside a shared store? OWASP LLM08 warns that where groups share the same vector database, "there's a risk of context leakage between users or queries", and recommends "permission-aware vector and embedding stores".
2. Deployment options. Can it run in your cloud account, your VPC, on-premise or air-gapped? Ask about SSO and SCIM, private networking, and encryption in transit and at rest, and which options exist today.
3. Audit trail. Can you reconstruct, per turn, what the agent read, what entered its context, which tools it called, who approved what and what it wrote back? OWASP LLM08 recommends "detailed immutable logs of retrieval activities". The method is in how to audit what an AI agent saw and did.

How do you check for prompt injection and excessive agency?

Treat every document an agent retrieves as untrusted input: OWASP LLM01 states that "it is unclear if there are fool-proof methods of prevention for prompt injection". Indirect injection, where instructions hide in files or web pages the agent reads, is the form to plan for once agents read company knowledge. The controls that matter limit the damage:

• least privilege for every tool, with read-only access where reading is enough;
• untrusted content kept separate and clearly marked;
• human approval for high-impact actions;
• authorization enforced in the downstream system, which OWASP LLM06 calls "complete mediation", not left to the model.

Then test it: plant a document with hidden instructions in a sandbox copy of your knowledge base and confirm the agent cannot act on it. The NIST AI Risk Management Framework, released on January 26, 2023 for voluntary use, and its Generative AI Profile (NIST-AI-600-1) give you a structure to record these decisions.

How does elephant.broker answer these checks?

elephant.broker, a pluggable runtime for AI agents, publishes these answers on its website. Verify each one in your own review.

Check	What the elephant.broker website states
Data location	EU regions and sovereign hosting, or self-hosted in your own VPC or air-gapped network
Credentials	No connectors and no keys held; your agents use the access you already gave them
Copies or pointers	Pointers to your systems: "Nothing moves."
Retention and training	Zero-retention pass-through to model providers; retention windows set per memory class; memory not used to train anyone's model
Tenant isolation	Single-tenant by default
Deployment	Cloud, private cloud or fully on-premise; private networking, encryption in transit and at rest, SSO/SCIM, scoped keys
Audit trail	Signed, append-only audit log; every read, placement, write-back and approval recorded
Agency	Red lines blocked before execution; humans approve where it matters

Prompt injection is not on that list, so include it in your own tests, as with any system that reads untrusted documents.

Sources

• elephant.broker: security, privacy and deployment, features
• OWASP: Top 10 for LLM Applications 2025, LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency, LLM08:2025 Vector and Embedding Weaknesses
• Model Context Protocol: Security Best Practices
• NIST: AI Risk Management Framework

Product details come from each vendor's public documentation as viewed on 2026-10-23 and may have changed. Product names are trademarks of their respective owners; elephant.broker is not affiliated with them.