Testing AI on a process doesn't mean copying your data
The first objection an IT manager raises against an AI pilot is fair: will it copy our data somewhere we don't control? The answer should be no. A well-run pilot does not get a copy of the company's data. It gets narrow, supervised access to the few systems one process needs, for as long as it needs them.
Six rules for access
1. Access is scoped to one process. The agent sees only what that process needs, listed in advance with a reason for each source. Nothing else.
2. Reading and writing are separate. Different credentials, different limits. Anything that changes or deletes data goes through an approval threshold and a delay before it becomes final.
3. Every call is logged under one identifier, from the moment the agent receives a request to the moment the result lands. Anyone can trace what the agent read, why, and what it did next, without reconstructing anything.
4. The agent has its own identity. Not an employee's account, not an administrator password, not a shared key. Its credentials expire quickly, renew automatically and can be cut off at once.
5. Your existing systems remain the reference. If the agent's result and your management software disagree, the software wins. The agent proposes and organises; it does not become a second set of books.
6. Each record it touches carries its rules: what it is, who vouches for it, how it may be used. The access list governs the process; those rules govern each record.
Access is earned, like a new hire's
A new employee gets a laptop, an email address and access to the systems their job needs. Not the keys to every server. Access grows as they prove themselves. Treat an AI agent the same way. On day one, one process, one access list, one set of credentials. After it has proved itself on the first process, it may be given a second, with its own list and its own credentials. Nothing is shared between them.
What goes wrong otherwise
The common failure is to start with broad access "to get something working" and promise the controls for later. Within two months the pilot holds its own version of the truth, nobody can reconcile it with the accounts, and the project is stopped. The controls are not polish. They are the condition for starting.
If your provider cannot explain these six rules for its own product, that is your answer.