When a company wants to use an AI Agent to organize sales quotations, compare procurement contracts, or consolidate customer complaints, the first question is usually not whether the model is intelligent enough, but whether the data can leave the company. Quotations contain cost information, contracts include transaction terms, and customer complaints may contain personal data. Yet if the vendor has no visibility into any of this content, who will determine exactly what the AI Agent did when something goes wrong?
Keeping sensitive data away from vendors does not mean that enterprises must give up using AI Agents. Companies need to address two separate concerns: vendors must not be able to view the data itself, while the company must still have access to a complete execution trace. The former depends on deployment location, intranet connectivity, and outbound connection restrictions; the latter requires company-managed records and approval workflows.
Vendors Cannot See the Data, but the Company Must Still Be Able to Review the Work Records
Legal technology company Legora faces a clear constraint: the data belongs to its law firm clients, so Legora cannot view the execution traces created when an AI Agent assists lawyers with their work. The system can help draft and edit Word documents, review 10,000 contracts in a single spreadsheet, and conduct due diligence. However, the vendor’s ability to support these tasks does not mean it can access the contents of its clients’ data.
This example also highlights an important distinction for Taiwanese enterprises: maintaining confidentiality from external parties and enabling internal traceability are two separate matters. A company can prevent external vendors from accessing quotations, procurement terms, or customer data, while its information security, compliance, and process owners still need to know what data the AI Agent accessed, which tools it called, what results it produced, and who ultimately approved their release. If a company keeps no internal records in the name of confidentiality, it will see only the final result when an error occurs, with no way to determine whether the problem originated in the data, the model, the search process, or the workflow configuration.
The first step, therefore, is not selecting a model. It is identifying the data that each stage of the workflow will access and determining who may view it. Companies should begin by mapping their data flows and documenting each data source, sensitivity level, storage location, authorized users, and whether vendors can access it. If any one of these points cannot be clearly explained, the entire workflow should not yet be handed over to an AI Agent.
Decide Between On-Premises and Cloud Deployment Based on Where the Data Will Flow
Companies do not need to deploy the entire system in one location. On-premises deployment is appropriate for data that cannot leave the company’s environment, while hybrid deployment allows sensitive data to remain internal and sends only approved tasks to cloud-based models. For example, when comparing procurement quotes, the system can first retrieve part numbers, historical prices, and vendor terms from the intranet, then send content with confidential fields removed to another environment for processing. The division should be based on the nature of the data and compliance requirements—not on the team’s preference for a particular brand.
When initially integrating internal systems, companies should also avoid giving an AI Agent permission to write data directly. When an AI Agent queries an enterprise resource planning (ERP) system, contract repository, or quality-control database, it is advisable to begin with read-only access. Once the team has confirmed that the query scope, permissions, and exception handling are all working properly, it can evaluate whether subsequent actions should be enabled. Outbound connections should follow a default-deny policy, with access granted only to domains required for the task. This prevents the AI Agent from switching to unreviewed external services while executing a workflow.
EgentWrX supports cloud, on-premises, and hybrid deployment. It can also allow an AI Agent to access databases through the company intranet using read-only connections. External domains are approved individually, enabling companies to divide tasks according to data sensitivity. The implementation team should now select a workflow with manageable risks, list the fields read and transmitted during each execution, and then determine which steps must remain within the company and which can be handled in the cloud.
How Can You Test and Troubleshoot When the Vendor Cannot See Customer Content?
Legora assembled three engineers and three lawyers to create a test environment that simulates actual client work, similar to building simulated worlds in reinforcement learning. Enterprises can likewise use de-identified or synthetic data to reproduce scenarios that commonly cause errors in real-world work, such as conflicting contract clauses, quotations with missing required fields, or procurement terms that exceed authorization limits. This allows vendors to test workflows without accessing real content.
Testing must go beyond checking whether the final answer is correct. Teams should separately examine data retrieval, search results, citations, and tool calls, while recording the model version used for each test. Legora once saw citation accuracy improve from 70% to 99% because the model version had been updated—not because the product itself had been modified. In other words, previous acceptance results cannot automatically be carried forward after a model upgrade. Tests that previously passed must be run again, and previously failed tests must be checked to determine whether they have genuinely improved.
Production workflows should retain an audit log, with designated personnel authorized to review it, a defined review frequency, and assigned responsibility for handling anomalous tasks. EgentWrX audit logs can be exported, and their integrity can be verified using a hash chain. The system also records when an administrator downloads the logs. Before going live, companies should conduct a drill by deliberately introducing a task with missing fields or insufficient permissions. The team should confirm that it can use the records to trace every step taken by the AI Agent and identify the person responsible for resolving the issue.
High-Risk Workflows Must Not Allow an AI Agent to Submit Results Automatically from Start to Finish
An AI Agent can connect intake, list preparation, document review, and follow-up work into a single workflow. However, legal reviews, due diligence, external quotations, and procurement approvals all involve clearly defined accountability. Legora CTO Jacob Lauritzen estimates that current models can properly complete approximately 60% of legal work, with the remainder still requiring more capable models. Although this is his estimate, it is sufficient to remind implementation teams that an AI Agent’s ability to complete part of a task does not mean it should execute the entire workflow without human oversight.
Companies can map their existing processes as relay diagrams and identify the points where the workflow must stop for human confirmation. A human approval gate should be added whenever content is about to be sent to a customer, an amount exceeds an authorization limit, terms are ambiguous, or different data sources conflict. Process documentation should also specify who is authorized to approve, who is responsible for revisions after rejection, and whether revised work must be approved again.
Start with workflows whose results are easy to verify and whose potential impact is limited, such as organizing contract lists or summarizing procurement discrepancies. Let the AI Agent handle the initial data preparation, while personnel make the final judgment and submit the results externally. Before production use, managers should personally confirm three things: sensitive data does not flow anywhere it should not, the company can access complete internal records, and every critical conclusion is reviewed and approved by a person before it is released.
FAQ
Can we still use an AI Agent if sensitive data is strictly prohibited from entering the cloud?
Yes. Companies can choose on-premises deployment so that tasks run on a central corporate server or employees’ computers, with databases accessed through read-only connections over the intranet. Before implementation, however, the storage location of the model, records, and backups must be verified individually. It is not enough to consider only where the system’s host machine is located.
If the vendor cannot view the work content, how can errors be investigated?
The company must retain audit logs that can be exported and whose integrity can be verified. These logs should record which data the AI Agent accessed, which tools it called, and who approved the results. Before implementation, the company should designate a records administrator, define access permissions and review intervals, and conduct a practical investigation drill using an anomalous task.
Do all tests need to be rerun after a model update?
At a minimum, high-risk and representative tests should be rerun because a model version update may change citation accuracy and tool-use performance. Teams should standardize their test data and scoring methods, preserve results from the previous version, and compare them with the new version to identify any regressions. Spot-checking a few answers that appear correct is not sufficient.
Which steps should require human approval?
Any step involving external submission, amounts above an authorization limit, ambiguous terms, or conflicts between different data sources should stop and wait for approval from a designated person. Process documentation must also specify who may approve the work, who is responsible for revisions after rejection, and whether the revised work must be submitted for approval again. Accountability should not be based solely on verbal agreements.
References
- Building Legal Agents When You Can't See the Data - Jacob Lauritzen, CTO of Legora — A Latent Space interview summary explaining how Legora tests legal AI Agents without access to customer data.
