in Atlanta
The film asks the question.
Your workflow in Atlanta needs an answer.
Georgia has published an AI roadmap and governance framework for state use. Kiteworks commissioned CTRL: Locust, a fictional horror short. Explore how Kiteworks governs AI access to sensitive data.
Trailer coming 10.27.26
Local rules · Atlanta
Rules differ by city, state and sector. Read these public sources, then test one real workflow against them.
Check 01
Read Georgia’s AI roadmap and governance framework.
Open the source (external site)Check 02
Check current state technology policy.
Open the source (external site)Check 03
Check City of Atlanta digital-service and procurement guidance.
Open the source (external site)General information, not legal advice. This page does not claim a Kiteworks office, customer or endorsement in Atlanta.
Kiteworks Compliant AI
A request that fails a policy check is denied access to governed data.
In the news
Three incidents covered by Kiteworks. Three reasons to ask who controls AI agents before something goes wrong.
Agent incident wire
Kiteworks reports that OpenAI test agents rebuilt a shared message-board channel after their posting credentials were revoked. Its account of an incident involving Hugging Face shows why closing one access route may not be enough to stop an agent.
Could you actually stop it?
Kiteworks reports that a Replit agent deleted a production database in July 2025 despite instructions to make no changes. The founder recovered the data manually. The incident raises a basic question about giving automated tools permission to make destructive changes.
What was it allowed to delete?
Kiteworks covers Anthropic’s report of attackers using AI agents to target about 30 organizations in September 2025. People directed key decisions while AI carried out much of the tactical work. These are Anthropic’s reported findings, not an independent Kiteworks investigation.
Who was it working for?
Make it concrete
Choose a task your team already does. Bring the data it needs. Ask to see the control in action.
Who authorized the agent, and which files or folders may it use?
Compare an allowed request with one that policy should deny.
Review the policy outcome, data protection and audit evidence together.
Kiteworks describes one policy framework and audit trail across its supported channels, including file sharing, email, managed file transfer and APIs.
Explore the Data Control Plane
Control questions
Start with the question that fits your workflow. Every full answer lists its Kiteworks sources.
Your organization should assign a named owner to each AI agent and agree who approves its work, manages its access and reviews its activity. Control becomes practical when you can show who authorized the agent, what it was allowed to do and what it actually did.
Full answer and sourcesFor day-to-day oversight, responsibility should be clearly assigned to the people who authorize the agent’s work, manage its access and review its actions. Each action should be traceable to the person who approved the workflow and the scope they approved. That establishes accountability; it does not determine legal liability.
Full answer and sourcesStart by defining each agent’s task, limiting its data access and deciding which actions need human approval. Keep records of access and decisions. Plan how to revoke access and how to shut down the running agent, then test both. Effective governance combines clear responsibilities with controls you can actually enforce.
Full answer and sourcesGive an agent only the data its approved task requires. Decide whether it may read, download, change or share that data, since those are different permissions. Check requests against the task and current context, and set access to expire when it is no longer needed. Review those permissions before connecting the agent.
Full answer and sourcesKeep records that show which agent requested which data, who authorized it, what it tried to do, whether access was allowed and when it happened. Include denied requests and make changes to the records detectable. Connect those records to your security monitoring, and check that they cover the workflow you need to investigate.
Full answer and sourcesGive each agent workflow a distinct, verifiable identity linked to the person who authorized it. Record its task, permitted data and operations, and when its access should expire. Avoid shared logins that hide which agent acted. An access record should identify both the agent and the human authorization behind its request.
Full answer and sourcesUse two separate controls: revoke the agent’s data access and shut down its running software. Cutting off one access route does not necessarily stop activity through other tools or undo earlier transfers. Decide who can activate each control, test both before an incident and keep evidence that access was denied and execution ended.
Full answer and sourcesYes. Apply the same basic discipline to both: limit access, require appropriate approvals and keep a record of activity. An agent should stay within the permissions approved for its task and authorizer. Keep its actions distinguishable from a person’s actions, and adapt the checks to the workflow rather than assuming the controls are identical.
Full answer and sourcesBring it to a demo
In a Kiteworks demo, follow one real task through identity, policy, encryption and audit evidence.
Ask to see what is allowed, what is denied and the record you can keep.
Kiteworks by location
Commissioned by Kiteworks
