Policy stories

Problem-first guides to governing AI agents. Each one takes a specific risk — a leaked secret, exposed CRM data, an unwanted write — and names the DTwo policies that address it.

• SLACK · DLP

  Stop AI agents from leaking secrets into Slack

  Once an agent posts to Slack, an API key is in channel history and search. Catch it before the send, not after.

  For: Platform and InfoSec teams running an AI assistant with Slack write access

• CRM · PII

  Keep customer PII from walking out of your CRM

  An agent reading Salesforce or HubSpot pulls emails, phone numbers, and addresses into its context and your chat logs. Mask them on the way out.

  For: RevOps and data-governance owners exposing a CRM to AI tooling

• CRM · ACCESS CONTROL

  Give AI agents read-only access to your CRM

  For a low-risk CRM pilot, give the agent a one-way mirror: it reads every record and changes none. The read-only policies enforce that, and a query allowlist tightens it further.

  For: Teams piloting AI on a CRM who want zero write risk

• HUBSPOT · ACCESS CONTROL

  Guard the CRM writes your revenue depends on

  You want agents logging activities and creating records, just not closing deals or reassigning owners on their own. Gate the few writes that matter.

  For: RevOps teams who want productive agents without high-impact mistakes

• JIRA · ACCESS CONTROL

  Wall off sensitive Jira projects from AI agents

  Security, legal, and HR projects share the same Jira as your sprint board. Keep agents from reading or writing them, and redact whatever still comes back.

  For: Teams running AI on Jira with confidential projects in the same instance

• SLACK · ACCESS CONTROL

  Slack hygiene for autonomous AI agents

  Slack's OAuth scopes pick capabilities, not the channels they apply to: you can grant an agent 'post messages,' but not 'post only in #status' — one scope covers every channel at once.

  For: Platform teams granting agents Slack access beyond a single channel

• HIPAA · MINIMUM NECESSARY

  HIPAA-aligned controls for AI agents touching PHI

  A connector into email, a helpdesk, or a warehouse can pull protected health information into an agent's context. These policies support HIPAA-aligned minimum-necessary, access, and de-identification controls on the MCP path.

  For: Security and compliance owners exposing PHI-adjacent systems to AI

• PCI DSS · PAN MASKING

  Keep cardholder data out of an AI agent's reach

  A PAN can surface in a chat message, a support ticket, or a warehouse query. These policies support PCI DSS-aligned masking and least-privilege controls on the agent channel.

  For: Teams whose AI tooling can reach systems that store cardholder data

• SOC 2 · ACCESS CONTROL

  SOC 2-aligned access control for AI agents

  Auditors increasingly treat an agent as a privileged identity. These policies support the most-tested SOC 2 access, boundary, and change-management criteria — with a per-decision audit trail.

  For: Teams carrying a SOC 2 report into every security review

• SOX · ICFR

  SOX-aligned controls for AI agents in finance systems

  An agent in the ERP can draft — but it should never post, pay, delete, or approve on its own. These policies support SOX ICFR and ITGC controls on the agent channel.

  For: Finance and audit owners piloting AI against the systems of record

• MICROSOFT 365 · EMAIL SECURITY

  Stop an AI agent from sending mail as your employees

  An agent with mailbox access can email outsiders, and quietly set forwarding rules that leak every future message. Gate the send and freeze the rules.

  For: IT and security teams connecting an agent to Microsoft 365 or Gmail

• FILE STORAGE · EXFILTRATION

  Keep an AI agent from sharing your files with the internet

  A file connector's most dangerous tool isn't read — it's the one that mints a public share link. Deny anonymous links and fence the folders that matter.

  For: Teams exposing Google Drive, Box, or Dropbox to an AI assistant

• DATA WAREHOUSE · DLP

  Let agents query the warehouse without draining it

  Natural-language SQL is one tool call away from a full-table export. Constrain the statement, cap the pull, and mask what comes back.

  For: Data platform owners exposing Snowflake, BigQuery, or Databricks to agents

• STRIPE · MONEY MOVEMENT

  Let an AI agent touch Stripe without letting it move money

  Refunds, payouts, and disputes are irreversible the moment they fire. Cap the amounts, gate the approvals, and close the raw-API back door.

  For: Finance and RevOps teams giving an agent access to payments

• GITHUB · SOURCE CONTROL

  Give an agent GitHub access without letting it merge or leak code

  Source code is crown-jewel data, and a merge or a public repo is a one-call mistake. Keep the agent to drafts and keep secrets out of commits.

  For: Engineering and platform teams running an agent against GitHub

• GLEAN · AGGREGATION

  Govern the one search tool that reaches every system

  Enterprise search fans out across everything indexed, so one query can surface what a dozen per-app policies would each have caught. The chokepoint is egress.

  For: Security teams deploying Glean or similar enterprise search to agents

• ZOOM · SENSITIVE CONTENT

  Keep meeting recordings and transcripts need-to-know

  Recordings and transcripts are sensitive by default — comp talk, deal terms, health details. Gate who an agent can pull them for, and mask what it returns.

  For: Teams letting an agent summarize or search Zoom meetings

• GUSTO · HR / PAYROLL

  Keep payroll and compensation data out of an agent's reach

  An HR connector exposes salaries, bank details, and terminations. Fence the sensitive reads to HR, freeze the writes, and mask financial identifiers.

  For: HR and people-ops teams piloting an agent against payroll systems

• GDPR · DATA MINIMISATION

  GDPR-aligned controls for AI agents handling personal data

  Almost every connector an agent touches holds personal data. These policies support GDPR and CCPA-aligned minimisation and special-category controls on the MCP path.

  For: Privacy and data-governance owners with EU or California exposure