Data Access Controls
Agents must only access data they are explicitly authorised to see. Row-level and field-level controls limit exposure of sensitive information.
6 min•By Priygop Team•Updated 2026
Data Access Principles
- Row-level security: agents can only query records belonging to their authorised scope (e.g., a support agent for EU can only access EU customers)
- Field-level security: mask or exclude sensitive fields (e.g., full card numbers, SSNs) from agent query results
- Purpose limitation: an agent's data access is limited to the specific task it is performing
- Aggregation safety: agents can receive aggregated statistics but not the underlying individual records
- Copy restrictions: agents should not be allowed to export data to external services without explicit approval
Key Takeaways
- Agents must only access data they are explicitly authorised to see.
- Row-level security: agents can only query records belonging to their authorised scope (e.g., a support agent for EU can only access EU customers)
- Field-level security: mask or exclude sensitive fields (e.g., full card numbers, SSNs) from agent query results
- Purpose limitation: an agent's data access is limited to the specific task it is performing