AI Agents Need Keys, Not Blank Cheques

Spain’s data protection authority has one message for anyone who lets AI agents act on their behalf: hand over keys, not blank cheques.

On 27 October 2026 the Agencia Española de Protección de Datos (AEPD) published a decalogue for users of AI assistants and agents. The AEPD wrote it for individuals, not compliance teams. Yet read with an organisation in mind, it is a ready-made control list for AI agents at work.

Why a user guide on AI agents matters to the AI lead

The AEPD’s starting point is the difference between answering and acting. When an assistant only answers, a mistake is a wrong sentence. When AI agents act, a mistake is an email sent, a file shared or a purchase made.

Before anyone delegates a task, the AEPD asks five questions. What can the assistant see, and what can it remember? What can it do in my name? Where does it send data? Does it affect other people?

The final section of the guide itself turns to people who use these tools at work. Employees should use only the assistants their organisation has authorised. Nobody should connect work email or documents to a personal AI account. Data about clients, patients, students or citizens remains the organisation’s responsibility, and doubts go to the data protection officer.

That last point moves the guide from the user’s desk to the AI lead’s. If staff may use only authorised assistants, someone has to decide which ones qualify and on what terms.

Four controls hidden in the advice on AI agents

Grant access, not a blank cheque

Reading is not the same as sending, editing or deleting, the AEPD notes. Its advice is to give the minimum: read-only access where possible, access limited to specific folders or calendars and a regular review of connected services. For an organisation, that is a permission model, decided once for each agent rather than by each employee at the moment of connecting.

Confirm what matters

The sixth recommendation asks users to switch on prior confirmation for sending, sharing, deleting, paying or accepting terms, and to avoid “always allow”. The AEPD also warns that a user may be responsible for actions they authorised. In a workplace, the same logic decides which actions need a human approval step before an agent may take them.

Distrust what it reads

Emails, web pages and PDFs may carry hidden instructions aimed at the agent. The AEPD says no measure removes this risk completely, so the best protection is to limit what the agent can do if someone deceives it. It advises against tasks that combine reading untrusted content with access to private data and the ability to act.

That combination describes a typical inbox assistant. It is the clearest design rule in the guide.

Know how to stop it

The tenth recommendation is to know how to halt the agent and revoke its access before you need to, and to review its activity logs. We made the same argument in April about agentic AI and human oversight: oversight after an action completes is audit, not oversight.

Memory and other people’s data

Two further recommendations matter more at work than at home. The fourth asks users to decide what an assistant may remember, because memory builds a profile over time. The AEPD points to the provider’s own memory, history and privacy controls, and notes that deleting a chat, a memory or a connected app have different effects. Asking the assistant to forget is not the same thing.

The eighth recommendation concerns other people. Contacts, chats and files hold information about people who never agreed to AI processing, and the user’s authorisation does not cover their data. For AI agents with access to a shared mailbox or a client folder, other people’s data is the daily material. The organisation, not the employee, answers for it.

What the AEPD expects from providers of AI agents

The guide also lists what providers of AI agents should offer. Read together, the items form a procurement checklist:

• permissions a user can understand;
• configurable confirmation for high-impact actions;
• an activity history;
• an immediate stop;
• memory management and deletion;
• clear information on who receives data and whether the provider trains on it;
• a simple way to exercise data protection rights.

Each item is a question for a vendor before anyone connects an agent to company systems. Where a vendor cannot show the stop function or the activity history, the organisation is buying a system it cannot supervise, the gap we described on Tuesday in who actually understands your third-party AI.

The rule on authorised assistants also belongs in the acceptable use policy. Our piece on the GWG Holdings ruling showed what happens when people use consumer chatbots for work. The policy has to name the permitted tools before the question reaches a court.

What this means for the AI lead

The AEPD wrote for users, but the decisions it describes cannot sit with users alone. Which AI agents staff may use, what each may read and do, which actions need confirmation and who can stop it: these are organisational choices. Until someone makes those choices for AI agents, every employee makes them separately.

The tip: take the AEPD’s five questions and attach them to every request to connect an agent to company email, calendars or files. Nothing gets connected until each question has a written answer.