Controlled AI agents

AI agent governance & privacy: control, not compliance promises

AI-agent governance here means making rules, ownership, data boundaries and approval boundaries visible for agentic work. It is not legal advice and not an automatic GDPR or EU AI Act compliance claim.

The practical problem

An agent can act only as controllably as its access, scope and approval path are defined. Privacy-oriented work therefore starts with a verifiable operating decision, not with a label.

Operating model

A privacy-oriented decision before execution

  1. 01Task & data class
  2. 02Allowed providers / tools
  3. 03Local or external access
  4. 04Scope & protected areas
  5. 05QA / approval
  6. 06Record the decision

The diagram describes a decision model, not a certification or legal assessment.

Controls that fit the current foundation

AI Operator Bridge is local-first by design: allowed repositories, protected areas, QA packs, risk-based review cues and a local decision ledger help classify work rather than merely run it.

  • Explicitly allowed local repositories
  • No automatic approval of push, merge or deploy
  • Protected areas and review cues
  • A local decision trail instead of hidden chat history

What a privacy policy does not solve automatically

Provider choice, legal basis, retention, organisational roles and handling of personal data remain the operator’s responsibilities. A tool can support data and execution boundaries; it cannot guarantee compliance.

Profiles as an operating model

Maximum AI, EU Privacy, Enterprise and Air-Gapped are useful profile names for different risk boundaries. In AI Orchestrator they are currently planning and concept framing, not certified or fully published profiles.

Capability status

What is available — and what is not

Status: AVAILABLE_NOW

Local boundaries and human gates

The local Bridge workflow foundation supports protected areas, review cues and explicit approvals.

Status: LIMITED_OR_EARLY

Privacy-oriented operation

Local-first operation and configurable boundaries can support a privacy-oriented approach; they do not replace an individual legal or organisational review.

Status: PLANNED

Formal governance profiles

Complete productised Enterprise or Air-Gapped profiles are planned or conceptual, not shipped compliance features.

Next useful step

Explore the relevant part of the operating model or review the local product foundation.

Review the local Bridge approach