Security and data practices

AI workflow agents need clear limits on what they can access and do. Service Time Lab designs security controls around each project’s workflow, data, systems, users, and risk.

Separate access for engineers and agents

Our forward-deployed approach brings engineers close to your workflow. Engineering access should be authorized for named people and environments, limited to the agreed scope, and reviewed during delivery.

At handoff, access should be removed, transferred, or reduced. Engineer access and agent permissions should be documented separately for their respective roles.

Controls shaped by the workflow

The following practices guide project design and should be agreed before production use.

Map data and provider use

Document what information the agent receives, where it is stored, which providers process it, and what is logged. Identify relevant provider settings and retention options before launch, and review decisions as terms and capabilities change.

Limit data and system access

Use only the information, identities, tools, and permissions the workflow needs. Mask or exclude sensitive fields where practical. Enforce authorization in application code, independently of model instructions.

Keep consequential actions reviewable

Define when the agent must pause for an authorized person to approve, edit, reject, or take over. Include high-impact actions, unusual requests, and uncertain results in the review rules.

Protect credentials

Use the deployment environment’s approved method for managing secrets. Keep passwords, API keys, and connection strings out of prompts, public client code, and source control.

Test and trace behavior

Test representative and failure cases. Where appropriate, record tool use, errors, approvals, and outcomes to support review and improvement. Restrict access to these records because they may contain business information.

Plan for failure

Define timeouts, retry limits, checks on results, fallback behavior, and escalation. The workflow should handle unavailable systems and incomplete or incorrect model output without continuing indefinitely or failing silently.

Clear responsibilities from the start

The services agreement should define security, privacy, retention, support, and incident responsibilities, including any operational, contractual, or legal requirements.

Service Time Lab

  • Design and implement controls within the agreed scope.
  • Document data flows, permissions, and operating limits.

Your team

  • Authorize access and identify restricted or regulated information.
  • Manage users and source systems, and approve operating rules.
  • Use the system consistently with applicable obligations.

Guidance that informs the work

Where relevant, project design may draw on:

These references do not imply certification or formal compliance.

Talk through your data and access needs

Describe the workflow, the systems involved, and where human approval matters. We’ll help assess the scope and controls the project would need.

A high-level description is enough. Please leave out confidential or sensitive data.

Discuss Your Workflow