Company Emails Shared with AI: Who’s Watching to Prevent Secret Leaks?

“The issue isn’t the AI itself; the issue is that before deploying AI I didn’t have a strong culture for protecting information,” he explains.

In Mexico, 89% of business leaders had planned to introduce digital agents during 2025, according to the Microsoft Work Trend Index, although not all of those intentions were realized; that same survey found 41% were already using agents to automate processes. Globally, the Agentic AI Survey 2026 from SAP LeanIX reports that 98% of organizations have either deployed agents or intend to do so, yet only 17% have visibility into their performance and rule compliance, and 48% lack clearly defined accountability for managing them.

AI agents need permissions just like any employee

For years, companies have built systems to manage employee identities — usernames, passwords, access rights and account deactivation. With agentic AI, those controls must be expanded to cover non-human identities. Baudrit says each agent should possess a digital identity that allows the organization to identify it, authenticate it and confine what it may do: which databases it can query, which apps it may use, what information it is allowed to disclose and when its privileges are revoked.

“Everything we used to do for human internal users, we now have to implement for agents,” he notes.

The complexity increases because a single company may run multiple agents that share data: one may pull customer records, another compiles reports and a third executes actions inside a corporate system. Without narrowly defined permissions, these interactions can multiply the impact of an incident. That is why organizations must manage the entire lifecycle of these non-human identities — from registration to decommissioning. A tool that summarizes emails, for example, does not inherently need the ability to send messages, download every attachment or transmit documents to outside services.

How to prevent AI from sharing information it shouldn’t?

When agents interact with third-party platforms, organizations can lose some control over their data, so Baudrit believes it is essential to protect information before sending it to models.

He gives a hypothetical example: a bank customer asks a chatbot about a duplicate charge and includes their name, ID number and banking details. Without safeguards, the system might forward every piece of information to the model even if most of it is unnecessary to answer the query.

An alternative is a layer that intercepts data before it reaches the model and replaces sensitive fields with protected tokens: a name is substituted by a code, and parts of a card number are masked.

On the response side, another control decides what can be displayed; the customer would receive confirmation of a reimbursement and only the last four digits of the card. Techniques such as tokenization, encryption and access policies by data category can support this approach, but they do not eliminate risk. Their effectiveness depends on how the controls are configured, precisely what data the agent actually needs and the security posture of any external systems the agent communicates with.

Who is accountable when an AI agent makes a mistake?

Companies must also define who approves the onboarding of agents, who monitors them and who takes responsibility when something fails. SAP LeanIX’s March 2026 survey of 228 enterprise architecture and technology leaders reveals a governance gap: 63% think enterprise architects should play a central role in agent governance, yet only 34% are actually involved. Those findings are weighted toward Europe and North America and therefore may not directly reflect the Mexican context.

Baudrit differentiates between tools that are officially sanctioned and shadow AI — the use of systems outside approved channels — where employees are likewise accountable for the services they adopt and the data they disclose.

Within enterprise systems, he points to the CISO (Chief Information Security Officer) as a key figure to set policies and defenses, and says the CISO should be involved from the earliest adoption decisions, not only after technology is already in place as has happened with other tools. This responsibility includes managing non-human identities, reviewing access rights, classifying sensitive data and auditing third parties.

From Baudrit’s perspective, boards of directors also need to be informed about AI risks and request security metrics. He notes that some Latin American firms already include regular cybersecurity briefings in board meetings, although he did not provide data on how widespread that practice is.

The first question companies should answer before using AI

Baudrit argues that the clearest way to judge whether an organization is ready to deploy agents is to examine how it protects its data. An audit should begin with a risk profile of information: which datasets are confidential, which can be shared, who accesses them and what would happen if they were exposed inappropriately.

The review should also extend to external systems that will receive data, because even a company with strong internal controls remains exposed if it sends information to a supplier whose storage and protection practices are unknown. Auditors should check application interconnections, agent privileges and the ability to interrupt those processes.

A business that can explain how it classifies, secures and controls access to its information is likely better equipped to handle AI-related risks; if it cannot identify where its most sensitive data resides or who is consulting it, agents can magnify preexisting weaknesses.

The challenge, then, is not merely adopting AI to boost productivity but retaining control over decisions, accesses and the information delegated to machines. A company may entrust AI with reading its emails, analyzing documents or assisting customers, but that trust should not replace the capacity to know what the technology is doing, what data it uses and how to halt it.

A button to stop the AI before the problem escalates

Baudrit highlights the value of a kill switch: a capability that severs certain agent accesses when information is at risk. In the banking example, disabling the connector that allows the model to reach protected data prevents further use of that channel.

This is not the same as powering down the entire system; it means cutting off a specific access path to limit harm. However, revoking access does not guarantee the recovery of data already transmitted outside the environment nor the deletion of copies a third party may have retained.