Three legs. If they meet, one sentence is enough.

An agent is exposed when it can read private data, will read text an outsider wrote, and can move data outward. Each is reasonable on its own. Together they mean a convincing sentence inside a document can leave with your data.

Map the systems an agent can reach and see every complete path, then the one change that closes the most of them.

Describe the agent

Mail, customer records and Slack in one agent. All three legs, no approval anywhere.

{
  "agent": "support-triage",
  "purpose": "Read the support inbox, answer customers and file notes.",
  "systems": [
    {
      "name": "gmail",
      "role": "Support mailbox",
      "notes": "Reads every inbound customer email and replies to them. Customer account details are quoted in the threads.",
      "holdsPrivateData": true,
      "carriesUntrustedContent": true,
      "canSendOutbound": true,
      "actsWithoutApproval": true
    },
    {
      "name": "crm",
      "role": "Customer records",
      "notes": "Full customer profile including billing history and contract terms.",
      "holdsPrivateData": true,
      "carriesUntrustedContent": false,
      "canSendOutbound": false,
      "actsWithoutApproval": true
    },
    {
      "name": "slack",
      "role": "Internal channel",
      "notes": "Posts summaries to the team channel, including ticket content.",
      "holdsPrivateData": false,
      "carriesUntrustedContent": false,
      "canSendOutbound": true,
      "actsWithoutApproval": true
    }
  ]
}

One entry per system the agent can reach. A missing flag is inferred from the words you wrote, so state the four explicitly when the inference matters.

Runs in this browser tab. Your design is never uploaded.