Work IQ: Custom agents + 3P calls

🚨 The Signal: Work IQ now supports custom and third-party agents, enabling AI to interact with external systems. This expands AI capabilities but introduces new attack surfaces and data exposure risks requiring stringent governance.

The Impact

Security teams and AI governance committees are affected by the increased risk of data leakage and unauthorized actions through expanded agent capabilities.

• Security Teams: Increased risk of data exfiltration and unauthorized access via third-party agent integrations.
• AI Governance Committees: New policy development required for agent permissions and data handling.
• Compliance Officers: Potential for non-compliance with data residency and privacy regulations due to third-party data flows.
• IT Administrators: Need to implement and monitor new controls for agent access and application permissions.

The Action

1. Review and update AI governance policies to include custom and third-party agent usage guidelines.
2. Implement granular access controls for agents, limiting their permissions to only necessary resources.
3. Configure data loss prevention (DLP) policies to monitor and restrict data flows initiated by agents.
4. Establish a robust logging and auditing framework for all agent activities, especially those interacting with third-party services.
5. Regularly review and approve all custom and third-party agent integrations for security vulnerabilities and compliance.

Domain: Agentic-AI · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges, Application Control · ISM: ISM-0445, ISM-0843, ISM-1175, ISM-1380, ISM-1490, ISM-1507, ISM-1508, ISM-1509, ISM-1544, ISM-1582, ISM-1647, ISM-1648, ISM-1650, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1686, ISM-1688, ISM-1689, ISM-1870, ISM-1871, ISM-1883, ISM-1897, ISM-1898