# Security questions to ask before giving an AI employee your inbox Published by 3Gen Internet Corporation, maker of OpenAssistant, Skej and AGNT. Comparisons use public documentation, without hands-on testing. ![An envelope and professional identity badge protected inside a ceramic shield beside a key, magnifying glass and blank security-question cards.](https://bestaiemployees.com/images/security-questions-before-giving-ai-employee-access-7cdf62cc1fb9.webp) Ask 22 questions before an AI employee gets your inbox and logins, in seven groups from access to exit. The list also shows what [OpenAssistant](https://openassistant.us/?utm_source=bestaiemployees\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-employee-access) publishes on a few of them, so you can see what a real answer looks like. An AI employee that reads your inbox and acts in your systems behaves like a new kind of insider: it holds credentials, reads untrusted text all day, and can take actions. This checklist has 22 numbered questions in seven groups. Use it as a vendor questionnaire and as your own internal review. A ready-to-send email is at the end. This is not legal advice, and it is not a substitute for your security team. Each "Why it matters" line is our own reasoning unless it links a source. Our primary sources are: - **OWASP** Top 10 for LLM Applications: [LLM01 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) and [LLM06 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) . - **CISA** and international partners' guide to adopting agentic AI, released May 1, 2026 ([CISA](https://www.cisa.gov/news-events/news/cisa-us-and-international-partners-release-guide-secure-adoption-agentic-ai)). It names an expanded attack surface and privilege creep as risks and recommends starting with low-risk, non-sensitive uses. - **UK NCSC** blog on the same guidance ([NCSC](https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai)): least privilege for the shortest time, limited scope, no long-lived credentials, and humans stay accountable. ## 1. Identity and access **1. Does the AI have its own identity and accounts, or does it act through mine?** Why it matters: if it uses your login, every action looks like you and revoking it means changing your credentials. A separate identity is easier to scope, log and switch off. Standards for agent identity are still early; NIST's NCCoE page we read shows a concept paper dated February 5, 2026, with its comment period closed April 2, 2026 ([NIST NCCoE](https://csrc.nist.gov/pubs/other/2026/02/05/accelerating-the-adoption-of-software-and-ai-agent/ipd)). **2. Exactly which permissions does it request, and can I narrow them?** Why: OWASP lists excessive functionality, excessive permissions and excessive autonomy as the root causes of excessive agency, and advises limiting the permissions granted to other systems ([OWASP LLM06](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)). Ask for the full list of OAuth scopes. "Read and send all mail" is not the same as "read one folder." **3. How long do its credentials last, and how do I revoke them?** Why: the NCSC says to avoid long-lived credentials ([NCSC](https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai)). You want a one-step revoke that you have tested. **4. Who in my company can connect it, and can an admin lock settings for everyone?** Why: one enthusiastic employee can connect it to a shared mailbox. Look for admin-only invitations and role controls. ## 2. Data and training **5. Do you, or your model providers, train on my data?** Why: "we never sell your data" is not the same as "we never train on it." Get the exact words. **6. Which subprocessors and model providers see my data, and where is it hosted?** Why: your data may pass through several companies. Ask for the list, the regions and how changes are announced. **7. What does it store from my inbox and files, for how long, and can I delete it?** Why: an agent that remembers also retains. Ask for retention periods for content, prompts and logs. **8. Can I exclude folders, domains, labels or accounts?** Why: mail it can never open cannot leak. Artisan, for example, lists exclusion lists for domains and accounts the agent will never touch ([Artisan](https://www.artisan.co/)). ## 3. Actions and approvals **9. List every action it can take. Which need approval by default?** Why: you cannot review what you have not listed. Ask about sending email, creating invites, deleting, sharing files, spending money, posting publicly and changing permissions, one by one. **10. Is approval enforced by a setting, or only requested in the instructions?** Why: a written rule guides; a setting enforces. A model can be talked out of a sentence in a prompt, but not out of a locked permission. **11. Does any setting proceed if I do nothing?** Why: a "confirmation window" is not approval. OA's own help center warns that a Confirmation Window is not the same as Manual approval ([OA help center](https://help.openassistant.us/en/articles/16302695-choosing-your-autonomy-and-supervision-settings)). Whatever the product, find the timeouts. **12. Can the AI approve its own work or change its own permissions?** Why: an approval the agent can grant itself is not an approval. Ask for this in writing. **13. Is there a hard stop and a spend cap?** Why: OWASP names excessive autonomy as a root cause. You need an off switch you have tested and a limit on how much it can spend or send. Examples that exist: Gemini Enterprise says you can set a budget cap per project and the agent pauses instead of overspending ([Google Cloud](https://cloud.google.com/gemini-enterprise)), and Lindy admins can set credit allocations per seat ([Lindy](https://www.lindy.ai/pricing)). ## 4. Prompt injection **14. What happens if an email, document or web page it reads contains instructions?** Why: this is the central risk for an agent that reads your inbox. OWASP says prompt injection occurs when inputs alter a model's behavior, and the indirect version arrives through websites and files the model reads. It says research shows retrieval-augmented generation and fine-tuning do not fully mitigate it ([OWASP LLM01](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)). Do not accept "our model is robust" as an answer. Ask what limits the damage if it fails. **15. Does it separate trusted instructions (from my team) from untrusted content (from outsiders), and what can outside content trigger?** Why: in our view the safest design lets a hostile email at most produce a draft for a human, not a send, a forward or a file share. **16. Can unauthenticated senders reach it?** Why: spoofed mail is an easy way in. OA's trust page says inbound email must pass sender authentication before it reaches the assistant ([OA trust](https://openassistant.us/trust.md)). That helps against spoofing but does not stop a real sender from writing a malicious email. **17. Has it been tested against injection, and can I see the results?** Why: ask for the test method, the date and who did it. A pen test summary under NDA is a reasonable answer. "We take security seriously" is not. ## 5. Logging and audit **18. Does it log every action: what it read, what it did, who approved?** Why: without a record you cannot find the cause or prove what did not happen. The NCSC says if you cannot understand, monitor or contain an agent's actions, it is not ready for deployment ([NCSC](https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai)). 11x, for example, documents recordings, transcripts and approval trails for its agents ([11x docs](https://docs.11x.ai/security/audit-and-oversight)). **19. Can I export the logs, how long are they kept, and who can see them?** Why: logs can be sensitive too. Ask whether the logs sit on a higher plan: in the table below, OA, Lindy and Artisan all list audit logs with their Enterprise plans. ## 6. Vendor and compliance **20. Which audits do you hold, and can I read the report?** Why: SOC 2 Type I covers a point in time and Type II a period. Ask for the report under NDA and check the product you are buying is in scope. **21. What are your incident notification commitments?** Why: you need a written time limit. HeyMilo, for example, states a 48-hour customer notification commitment for confirmed incidents ([HeyMilo](https://www.heymilo.ai/responsible-ai)). Ask for yours. ## 7. Exit **22. How do I leave: export, deletion, contract end and refunds?** Why: you want a tested way to disconnect everything, export your data and have it deleted. Ask for the deletion timeline in writing, whether deletion is permanent, and what happens to prepaid terms. ## What vendors publish on a few of these "Not stated" means the page we read was silent on it, which does not prove the feature is missing. All; vendor pages change. | Vendor | SOC 2 | Training on customer data | Audit logs | Approval controls | | --------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OA (ours) | Type II, audited annually by an independent CPA firm ([trust](https://openassistant.us/trust.md)) | "We never train on your data"; AI providers contractually prohibited ([trust](https://openassistant.us/trust.md)) | Exportable audit logs of administrative activity ([trust](https://openassistant.us/trust.md)); audit logs listed under Enterprise ([pricing](https://openassistant.us/pricing.md)) | Manual, Confirmation Window, Autonomous, set per action type ([help](https://help.openassistant.us/en/articles/15425929-supervision-autonomy-settings)); consequential actions staged for review; cannot approve its own work; account-wide stop ([trust](https://openassistant.us/trust.md)) | | Lindy | Type II ([security](https://www.lindy.ai/security)) | Says data is never sold or used to train models ([Lindy](https://www.lindy.ai/)) | Enterprise plan ([pricing](https://www.lindy.ai/pricing)) | Configurable write guardrails in shared Slack threads; private chats outside this setting ([integration docs](https://docs.lindy.ai/integrations/overview)) | | Artisan | Type II badge ([Artisan](https://www.artisan.co/)) | Not stated | "Role-based access & audit log" badge ([Artisan](https://www.artisan.co/)); listed under Enterprise ([pricing](https://www.artisan.co/pricing)) | Approve before sending; lock tone; banned phrases ([pricing](https://www.artisan.co/pricing)) | | 11x | Type II; report on request ([security](https://www.11x.ai/security)) | Says it does not train on confidential information ([docs](https://docs.11x.ai/security/brand-protection)) | Recordings, transcripts, approval trails ([docs](https://docs.11x.ai/security/audit-and-oversight)) | Three approval levels, including autopilot ([docs](https://docs.11x.ai/security/brand-protection)) | | Fin | Type II ([Fin trust](https://fin.ai/trust-reliability)) | May use anonymized data for fine-tuning; opt out any time ([Fin trust](https://fin.ai/trust-reliability)) | Not stated on its trust page | Procedures can trigger approvals ([Fin trust](https://fin.ai/trust-reliability)) | | Artie | None named ([Artie security](https://artie.ai/security)) | Anonymous sharing for AI improvement on by default where permitted; admins can opt out ([Artie security](https://artie.ai/security)) | Not stated | Choose access, set instructions, pause work ([Artie security](https://artie.ai/security)) | | Sintra | Not stated; GDPR badge only ([Sintra](https://sintra.ai/integrations)) | Says it does not train on your data ([Sintra](https://sintra.ai/integrations)) | Not stated | A setup step for "approval levels" ([Sintra](https://sintra.ai/)) | Two things stand out. Training terms differ more than headlines suggest: Fin and Artie describe opt-out arrangements, while OA, Lindy, 11x and Sintra say they do not train. And three of the seven vendors (OA, Lindy and Artisan) list audit logs with an Enterprise plan, so check which tier you need. ### What OA's pages say and do not say We publish OA, so we re-read its live trust page against this checklist ([OA trust](https://openassistant.us/trust.md)). It states the controls in the table above, plus an annual third-party penetration test with a summary under NDA, a published sub-processor list, and "Audit trails are available for key actions". Its September 2026 update says the assistant tracks where content came from, such as a web page or someone else's email, versus what you told it directly. What we could not find on that page: - The words "prompt injection", or any injection test results (questions 14 and 17). The provenance update and review before send are design statements, not test results. - A retention period for audit logs or prompts (questions 7 and 19). The trust page says what OA keeps "is set out in our Privacy Policy", which has a Data Retention section we have not summarised ([OA privacy policy](https://openassistant.us/privacy)). The pricing page lists "Audit logs & data retention" under Enterprise ([OA pricing](https://openassistant.us/pricing.md)). - Whether the audit trails for key actions can be exported, and who can see them (questions 18 and 19). - Hosting regions (question 6). It says infrastructure is primarily on AWS. - A customer incident notification time (question 21). It lists an Incident Response Policy available on request. Ask OA the same questions you ask anyone else. ## Email to send a vendor Edit the brackets and send. Keep their answers on file. > Subject: Security questions before we connect \[product] to our systems > > Hello \[name], > > We are evaluating \[product] for \[use case, e.g. managing a shared inbox]. Before we connect any account, please answer the following in writing. > > 1. Does the AI use its own identity and accounts, or does it act through a user's login? > 2. Please list every permission or OAuth scope it requests. Can we narrow them? > 3. How long do its credentials last, and how do we revoke them in one step? > 4. Can admins restrict who connects it and lock approval settings? > 5. Do you or your model providers train on our data, including prompts, files and email content? Please quote the contract language. > 6. Please list your subprocessors and model providers, hosting regions and data retention periods, including for logs. > 7. Which actions can it take without approval by default? Are approvals enforced by settings or only by instructions? Does any setting proceed if no one responds? > 8. Can the AI approve its own actions or change its own permissions? > 9. How do you defend against prompt injection from email, documents and web pages? Have you tested it, and can we see the results or a summary? > 10. Do you log every action, what it read and who approved it? Can we export logs, and for how long are they kept? > 11. Which audits do you hold (SOC 2 Type I or II, others)? Can we see the report under NDA, and is this product in scope? > 12. What is your incident notification time commitment? > 13. Is there a hard stop and a spend or sending cap? > 14. How do we export our data and leave? What is deleted, when, and is it permanent? > > We are happy to sign an NDA. Thank you. > > \[Your name, role, company] If a vendor will not answer in writing, treat that as an answer. When you roll out, our [30-day plan](https://bestaiemployees.com/first-30-days-with-an-ai-employee/) shows how to start with least-privilege access and approve-everything mode, and our [guide on what to hand to each](https://bestaiemployees.com/ai-employee-vs-human-hire/) shows which tasks to keep for people. For SDR tools, see [running an AI SDR safely](https://bestaiemployees.com/running-an-ai-sdr-safely/). ## Related reading - [Your first 30 days with an AI employee: a week-by-week onboarding plan](https://bestaiemployees.com/first-30-days-with-an-ai-employee/) - [Do you have to tell people they are talking to an AI? What the rules say](https://bestaiemployees.com/do-you-have-to-tell-people-its-an-ai/) - [Best AI assistants with their own name, email and phone in 2026](https://bestaiemployees.com/ai-assistants-that-work-like-a-hired-employee/) - [13 mistakes companies make when hiring AI employees (and 10 demo questions)](https://bestaiemployees.com/mistakes-hiring-ai-employees/) ## Frequently asked questions **What should I ask before giving an AI employee access to my inbox?** Use the 22 questions in seven groups: identity and access, data and training, actions and approvals, prompt injection, logging and audit, vendor and compliance, and exit. A ready-to-send email at the end covers the core questions. **Is a confirmation window the same as approval?** No. OpenAssistant's help center warns that a Confirmation Window is not the same as Manual approval. Whatever the product, find the timeouts. **What does OpenAssistant publish on security?** Its trust page says SOC 2 Type II audited annually by an independent CPA firm, that it never trains on your data, that inbound email must pass sender authentication, and that a summary of its annual third-party penetration test is available under NDA. It also publishes a sub-processor list. **Do audit logs cost extra?** Often on higher plans. OpenAssistant, Lindy and Artisan each list audit logs with their Enterprise plans, so check which tier you need. ## Try OpenAssistant If you want to see how an assistant answers these questions on a public trust page, [Try OpenAssistant](https://openassistant.us/?utm_source=bestaiemployees\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-employee-access). It has a free Starter plan, and the paid plans are on the [OpenAssistant pricing page](https://openassistant.us/pricing?utm_source=bestaiemployees\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-employee-access). ## Disclosure and Method Disclosure: 3Gen Internet Corporation publishes this site and makes OpenAssistant, Skej and AGNT. We publish these comparisons to explain our products alongside documented alternatives. Method: We have not run hands-on tests. This article rests on public information (vendor pages, documentation, pricing and published terms), with sources linked. Ranking basis: public information only, not hands-on use. Published by 3Gen Internet Corporation, the company behind OpenAssistant, Skej and AGNT. We review our own products alongside competitors. [How We Research](https://bestaiemployees.com/how-we-research/) Canonical: https://bestaiemployees.com/security-questions-before-giving-ai-employee-access/