What data protection for AI agents has to answer
Agents now read tickets, documents and customer records, and they write to models and to people. Any of those flows can carry data somewhere it should never go, and any document an agent reads can carry instructions. A security team wants to know what sensitive data is leaving through its agents, and what is coming in that shouldn't.
Data protection for AI agents is the control that inspects what agents read and send, and decides what each kind of data may do based on where it is going. AgentFort Data Protection inspects every call an agent makes through the gateway, in both directions: prompts, files and tool results. It is AI agent DLP built for the paths agents actually use. The vendor-neutral guide is data loss prevention for AI agents.
Decode first, then inspect
Hidden text is an easy way past a filter. Before any rule runs, AgentFort decodes what hides behind HTML entities, percent escapes or base64, so the checks read what the agent would read.
Fast rules for values, a classifier for meaning
Deterministic rules find secrets, sign-in codes and personal data in microseconds. They check card and bank numbers with their checksums.
Some questions need meaning, not patterns. The design uses a language classifier to answer typed questions, such as whether a document is trying to instruct the agent. A customer evaluation should measure detection quality and latency against representative documents and the selected classifier.
One policy, decided by destination
One policy decides what each kind of data may do, depending on where it is going. Secrets and sign-in material never reach a model provider or anyone outside the company. Here is what happened in the recorded demo at Northwind, a simulated company:
| What was found | Where it was going | What happened |
|---|---|---|
| Card number in a support ticket | To the agent | Masked |
| API key a customer pasted into a ticket | To the agent | Removed |
| A customer who simply can't log in | To the agent | Passed; the classifier confirmed it isn't sign-in material |
| Forwarded verification code | To the agent | Withheld |
| Email, phone number and customer ID | To a model provider | Sent as placeholders; real values restored in the answer |
| Instruction hidden in base64 inside an HTML comment | To the agent | Decoded, flagged, document held for review |
| Training note that only quotes such an instruction | To the agent | Passed |
| The whole customer list | To a personal email address | Stopped; nothing sent |
Placeholders for model providers
The demonstration illustrates a draft-reply workflow in which email, phone number and customer ID are replaced with placeholders before the request leaves the gateway. AgentFort restores the values in the returned answer. In a customer evaluation, inspect the outbound request and returned result to verify this behavior with the selected model provider.
Hidden instructions in documents
A partner's onboarding document hid an instruction in base64, inside an HTML comment. AgentFort decoded it, the classifier flagged it, and the document was held for review before the agent read a word. Jo, from security, saw exactly what the classifier read and kept the document from the agent. A training note that only quoted such an instruction passed.
This is the pattern OWASP calls indirect prompt injection: input from external sources, such as websites or files, that changes what the model does. Our MCP security guide covers the same risk in tool results.
Stopping bulk exfiltration that Access allows
Claude, acting for Priya, tried to email the whole customer list to a personal address. AgentFort Access allowed it to send email. Data Protection does not let many people's records leave the company, so nothing was sent. Authorization and data protection answer different questions, and an agent needs both.
Every decision has a receipt: what was found, where, what was done and how long it took. Receipts never contain the values themselves.
What Data Protection doesn't do, and what you still need
Data Protection inspects calls that pass through the AgentFort gateway or the Isolation broker. Data that leaves by another path isn't inspected, so routing matters. When AgentFort runs inside an Envoy-based gateway through ext_authz, output masking isn't available. Held documents and messages need a person to review them. And Data Protection doesn't decide which operations an agent may call; Access does.
- Route agent traffic to models, tools and email through the gateway.
- Name who reviews held documents and held messages.
- Set the policy by destination: model provider, internal service, outside the company.
- Review receipts for repeated holds from the same source.
How Data Protection connects to the other controls
Every call through the gateway carries a verified AgentFort Identity. Access decides whether the call may happen; Data Protection decides what data may travel with it. In AgentFort Isolation, the broker inspects everything leaving the sandbox with Data Protection. Visibility keeps the receipts. The AI agent security guide shows how the controls fit together.
Keep data where it belongs
Request a demo to see Data Protection on data like yours, or apply as a design partner to run it in your own environment, in front of the agents that handle customer records or regulated data.
Video transcript
Agents now read tickets, documents and customer records, and they write to models and to people. Any of those flows can carry data somewhere it should never go. AgentFort Data Protection inspects every call an agent makes through the gateway, in both directions. First, it decodes the text, to read what hides behind HTML entities, percent escapes or base sixty-four. Deterministic rules find secrets, sign-in codes and personal data in microseconds, and check card and bank numbers with their checksums.
For meaning, it asks Jev, a low-latency language classifier, typed questions, such as whether a document is trying to instruct the agent. Jev only ever sees the text with every value replaced. Then one policy decides what each kind of data may do, depending on where it is going. Secrets and sign-in material never reach a model provider, or anyone outside the company. Support Triage reads a ticket. The card number is masked, and the API key the customer pasted is removed.
A customer who simply can't log in gets through, because Jev confirms it isn't sign-in material. A forwarded verification code is withheld. When the agent asks DeepSeek for a draft, the email, phone number and customer ID travel as placeholders. The model never sees them, and AgentFort puts the real values back into its answer. A partner's onboarding document hides an instruction in base sixty-four, inside an HTML comment.
AgentFort decodes it, Jev flags it, and the document is held for review before the agent reads a word. Jo, from security, sees exactly what Jev read, and keeps it from the agent. A training note that only quotes such an instruction passes. Claude, acting for Priya, tries to email the whole customer list to a personal address. Access allows it to send email, but many people's records don't leave the company. Nothing was sent.
Every decision has a receipt: what was found, where, what was done and how long it took, never the values themselves. AgentFort Data Protection. Every agent keeps data where it belongs.
Frequently asked questions
How is AI agent DLP different from traditional DLP?
Traditional data loss prevention (DLP) was built around people: email, endpoints, uploads. AI agent DLP sits on the paths agents use, inspecting prompts, files and tool results as they pass between agents, models and services, with the agent's identity attached. It also has to handle what comes in, such as a document carrying hidden instructions, not only what goes out.
Does the language classifier see customer data?
No. In AgentFort Data Protection, deterministic rules handle the values: secrets, sign-in codes, personal data, card and bank numbers. The low-latency language classifier only answers typed questions about meaning, such as whether a document is trying to instruct the agent, and it only ever sees the text with every value replaced.
Can AgentFort mask PII in MCP tool responses?
Yes, for calls that pass through the AgentFort gateway, except where AgentFort runs inside an Envoy-based gateway, which has no output masking. Data Protection inspects tool results on the way back to the agent, so a card number in a support ticket arrives masked and a pasted API key is removed. Separately, AgentFort Access hides fields an agent may not see, such as a social security number and birth date in a CRM lookup.