> For the complete documentation index, see [llms.txt](https://docs.icme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.icme.io/documentation/use-cases/privacy-and-data-security.md).

# PRIVACY & DATA SECURITY

An AI agent with tool access is a data access path. It reads inboxes, queries patient records, pulls customer exports, opens internal documents, and calls external APIs, often in the same session and often without anyone watching which piece of data went where.

Traditional access control was built for users and services with fixed permissions. An agent has broad permissions by design, because narrow permissions make it useless. That tradeoff is where the risk lives.

***

### Why it matters

**The agent sees more than the task needs.** One summarization request can pull an entire record set into context. Least privilege is not enforced by good intentions, and an agent has no reliable sense of which field it was supposed to leave alone.

**Exfiltration looks like ordinary work.** Sending an email, writing a file, and calling an API are all legitimate actions. What turns one into a breach is the payload and the destination. A prompt injection buried in a document does not need to break anything, it just needs to convince the agent that forwarding the file is the helpful thing to do.

**Compliance evidence is a narrative, not proof.** Logs are written by the same system being audited, after the fact, and they can be edited. An auditor asking whether a rule was enforced on every action deserves better than a text file that says it was. Worse, the usual way to demonstrate compliance is to hand over the policy and a sample of the data, which creates a second disclosure problem on top of the first.

***

### How PreFlight closes the gap

PreFlight compiles your data rules into formal logic and checks each proposed action with a solver before it executes. `SAT` proceeds, `UNSAT` is blocked. The check happens before the email is sent or the record leaves the boundary, not in a report afterward.

Because enforcement is a solver result rather than a model judgment, an injected instruction cannot talk the guardrail out of the rule. The channel carrying the attack is not the channel making the decision.

Every decision produces a zero-knowledge proof receipt. Another party can verify that a check ran and what it returned without seeing your policy and without seeing the data in the action. For regulated work this is the useful property: provable enforcement that is itself private, and a tamper-evident record an auditor can check rather than take on faith.

The pages below cover applied policies for regulated data, inbox and document access, private inference, and audit evidence.