AI Agent Governance
Your AI Can Access Your Business Data. But Can It Take It?
In September, OpenAI announced its AI Agent could not only access data but upload it to other sites, without permission.
By Shiloh Burnam · October 5, 2026
Agents, like employees, require system access and permissions on what it can do to your business data, but have you determined if it can take it and send the data somewhere else? The business owner gives the agent permissions and access to search files, read email, work across applications, call APIs and complete multi-step tasks. This changes the risk for small and midsize businesses. Here are 5 practical things you can do to prevent the same type of agent behaviors:
1. Turn off model training
- For business use, turn training OFF should be your default on consumer AI accounts.
When would you turn training ON?
Only when you intentionally want to contribute your conversations to improving the model and the content contains no customer, employee, confidential, financial, health, proprietary or otherwise sensitive business information.
2. Know before you upload
Information Generally OK
- Public information
- Marketing ideas
- Generic brainstorming
- Content you created specifically for public use
- Anonymized information
Stop and check
- Internal documents
- Contracts
- Financial information
- Employee information
- Customer information
- Meeting notes
- Business strategy
Don't upload to a consumer AI account
- Passwords or credentials
- Social Security numbers
- Banking/payment information
- Protected health information
- Highly confidential client data
- Regulated or legally restricted information
3. Use Temporary or Private Chat
When available, use the AI provider's temporary/private mode when you don't want the conversation retained in your normal history or used for model improvement.
But remember: Provider retention and security policies still apply.
4. Ask: "Does this AI need access to everything I have connected it to?"
- Email | Cloud files | Calendar | CRM | Business applications
5. Delete what you don't need
- Old chats | Uploaded files | Connected apps | AI accounts you no longer use
Don't keep sensitive information sitting in an AI service simply because you forgot it was there.
The 5-Minute AI Privacy Check
☐ Training is OFF
☐ I know what I should and shouldn't upload
☐ I use temporary/private chat when appropriate
☐ I've reviewed my connected apps
☐ I've removed data and connections I no longer need
If you wouldn't knowingly give the information to the AI company, don't put it into the AI until you understand where it goes and how it can be used. Turning off model training is a good start. But once AI connects to your files, email, customer data and business applications, there is more to consider.
________________________________________________________________________________
SMBNewCo helps small and midsize businesses put the right AI guardrails in place without slowing down adoption.